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Abstract 

o 

Cn| In fault-tolerant quantum computing schemes, the overhead is often dominated by the cost 

^ of preparing codewords reliably. This cost generally increases quadratically with the block size 

^ of the underlying quantum error-correcting code. In consequence, large codes that are otherwise 

'""5 very efficient have found limited fault-tolerance applications. Fault-tolerant preparation circuits 

T-H therefore are an important target for optimization. 

We study the Golay code, a 23-qubit quantum error-correcting code that protects the logical 
qubit to a distance of seven. In simulations, even using a naive ancilla preparation procedure, 
the Golay code is competitive with other codes both in terms of overhead and the tolerable noise 
threshold. We provide two simplified circuits for fault-tolerant preparation of Golay code-encoded 
^ ancillas. The new circuits minimize error propagation, reducing the overhead by roughly a 

^ factor of four compared to standard encoding circuits. By adapting the malignant set counting 

^ technique to depolarizing noise, we further prove a threshold above 1.32 x 10~^ noise per gate. 

1 Introduction 

> 

A main obstacle to building a quantum computer is handling noise. The fault-tolerance threshold 
0^ theorem [AB97, Kit97] implies that reliable quantum computation is possible in principle. So long 

as the noise is weak enough, the probability that a computation executes correctly can be made 
arbitrarily close to one at the cost of increased circuit complexity, i.e., overhead. Fault-tolerant 
quantum circuit constructions typically aim to maximize the tolerable noise rate while maintaining 
^-H modest overhead. 

A quantum fault-tolerance scheme generally works by encoding data into a quantum error- 
^ correcting code and alternating steps of fault-tolerant computation and error correction (Figure 1). 

^ The error-correction step, intended for recovery from accumulated noise, is normally much more 

complicated than the computation step. Therefore error correction is the dominant factor in 
determining the scheme's resource overhead, and is usually the major bottleneck in determining the 
highest tolerable noise rate or "noise threshold." In particular, the details of how error correction is 
implemented are more important than the properties of the underlying quantum error-correcting code. 

For example, with the nine-qubit Bacon-Shor code, a fault-tolerant logical controlled-not (CNOT) 
gate between two code blocks can be implemented using nine physical CNOT gates, whereas an 
optimized error-correction method uses 24 physical CNOT gates [AC07]. For larger quantum 
error-correcting codes, the asymmetry between computation and error correction is greater still. 
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Figure 1: The circuit fragment above shows an example of alternating rounds of fault-tolerant error- 
correction (EC) and computation. The wires represent encoded data blocks and the gate symbols (CNOT, H, 
T) represent encoded operations. 

With the 23-qubit Golay code, a fault-tolerant logical CNOT gate requires only 23 physical CNOT 
gates, whereas a standard error-correction method uses 2400 physical CNOT gates. 

Larger quantum error-correcting codes, with higher distance and possibly higher rates, can 
still outperform smaller codes. Separate numerical studies by Steane [Ste03] (see also [Ste07]) and 
Cross, DiVincenzo and Terhal [CDT09] have each compared fault-tolerance schemes based on a 
variety of codes. They identify larger codes that, compared to the seven-qubit Steane code and the 
nine-qubit Bacon-Shor code, can tolerate higher noise rates with comparable resource requirements. 
In particular, their estimates single out the Golay code as a top performer. 

We give an optimized fault-tolerant error-correction procedure for the Golay code that uses 
only 640 CNOT gates. Our derivation is based on two main ideas. First, we simplify Steane's 
Latin-rectangle-based scheme for preparing encoded |0) states [Ste02], by taking advantage of 
overlaps between the code's stabilizers. Second, we reduce the overall number of encoded |0) states 
required for error correction by carefully tracking the exact propagation of errors. Both ideas are 
generally applicable to other large quantum error-correcting codes. 

We then prove a lower bound on the threshold for depolarizing noise of 1.32 x 10~^ noise per 
gate. This result is an order of magnitude improvement over the best previous lower bound for the 
Golay code [AC07] based on an adversarial noise model. It is also about 25 percent better than the 
lower bound due to [AGP08] based on a stochastic noise model slightly stronger than ours, but for 
a dramatically different fault-tolerance scheme. Our proof uses malignant set counting [AGP06], 
extensively tailored for our specific error correction circuits and for depolarizing noise. Instead of 
assuming adversarial noise at higher levels of code concatenation, the counting procedure keeps 
track of multiple types of malignant events to create a transformed stochastic noise model for each 
level, allowing for a more accurate analysis. 

1.1 Fault-tolerant error correction 

There are exceptions to the common paradigm, sketched in Figure 1, of alternating computational 
and error correction steps. In a scheme proposed by Knill, for example, error-correction and compu- 
tation are performed simultaneously by teleporting into specially prepared ancilla states [Kni04a]. 
Zalka [Zal97] has suggested balancing the costs of computation and error correction by having mul- 
tiple computation steps between error-correction rounds, but error propagation between code blocks 
makes such a scheme challenging to analyze precisely. Surface-code-based quantum fault-tolerance 
schemes make a more radical change: they implement encoded gates using gradual code deforma- 
tion, during which error correction occurs frequently. However, while these schemes appear very 
promising [RHG06, RH07], they have proved difficult to analyze precisely and rigorously [DKLP02]. 
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A variety of error-correction techniques have been studied, and three broad categories are 
so-called Shor-type [Slio96], Steane-type [Ste97] and Knill-type [Kni04a] error correction. This is 
only a rough categorization, and it leaves significant room for introducing new ideas and optimization 
within or beyond these categories; see, e.g., [Rei04, DA07, AC07]. The Shor-, Steane- and Knill-type 
error-correction schemes rely on the use of ancillary qubits to extract error information from the 
data blocks. Before interacting with the data, the ancilla qubits need to be prepared in an entangled 
state. (Surface-code-based schemes are again an exception, and the nine-qubit Bacon-Shor code is 
an exception at the first level of code concatenation.) 

As a concrete example, consider Steane-type error-correction. Arbitrary errors can be written 
as linear combinations of tensor products of Pauli errors: the identity I = (qi), a bit-flip error 
X = (Iq), a phase- flip error Z = ( J i*^ ) , and both bit- and phase-flip errors Y = ( ^ "^^ ) = iXZ. 
Each tensor product can itself be decomposed as a product of a Z-error part — a tensor product 
of / and Z operators — and an X-error part — a tensor product of / and X operators. Steane 
error-correction works by correcting Z and X errors separately. First, Z errors are copied from the 
data to an encoded |0) ancilla by transversal CNOT gates, i.e., CNOT gates from each qubit of the 
ancilla block to the corresponding qubit of the data. X errors are similarly copied onto an encoded 
ancilla state |+) = :^(|0) + The ancillas are then measured in order to determine a correction. 

Preparing ancilla states can be complicated, particularly because errors in the preparation circuit 
can spread through the ancilla block. For example, a single physical fault may lead to errors on 
multiple ancilla qubits. The code is limited by its distance and cannot necessarily protect against 
such correlated errors. As a result, the ancilla states themselves must be checked for errors. 

The complexity of verifying prepared ancillas against errors grows quickly as the code distance 
increases. For large codes, veriflcation of encoded |0) and |+) is accomplished by using additional 
identically prepared "auxiliary" ancillas. In a manner similar to error correction, errors from the 
initial ancilla are copied onto the auxiliary ancillas and then the auxiliary ancillas are measured. If 
measurements imply the presence of an error, then all of the ancillas are discarded and the entire 
process begins anew. Otherwise, the ancilla is accepted and may be used for error correction. Of 
course, the auxilliary ancillas may also contain errors. These errors can spread to the initial ancilla 
and invalidate the verification. Thus the auxiliary ancillas must also be checked for errors by yet 
more ancillas. The end result is a series of recursive verifications that involves many encoded ancillas, 
and dominates the overall overhead cost of error correction. 

To maximize efficiency, preparation and verification circuits may be constructed using a pipeline 
architecture in which part of the computer is dedicated to preparing many ancillas in parallel. Even 
so, ancilla production constitutes the majority of the space requirement for a fault-tolerant quantum 
circuit. In [IWPK08], for example, the ancilla pipeline is estimated to take up to 68 percent of the 
entire circuit footprint. 

For the Golay code, this recursive verification technique requires twelve encoded ancillas and at 
least 1177 CNOT gates. One such circuit is shown in Figure 2. Variants of this circuit have been 
used in previous studies of the Golay code, including in [Ste03] and [CDT09]. The construction of 
this circuit implicitly assumes a kind of worst-case error behavior in which all possible codeword 
preparation circuits propagate errors in the same way. However, DiVincenzo and Aliferis [DA07] 
have observed that different preparation circuits exhibit different error propagation behavior, and 
this can be exploited. By considering many different preparation circuits, we observe that some 
circuits give favorable combinations of correlated errors, and thus require fewer error verification 
steps, substantially reducing overhead. In Section 3 we provide two circuits that require only four 
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Figure 2: This circuit produces a single Golay encoded |0) state that is ready to be used in fault-tolerant 
error correction. Each of the twelve encoded |0) ancillas, denoted |0), is identically prepared using the Steane 
Latin rectangle method (see Section 3.1). The wires represent 23-qubit code blocks and the indicated CNOT 
and measurement operations are transversal. 











{A) 



{X) 



Figure 3: Our simplified ancilla preparation and verification circuit uses only four encoded |0) ancillas. The 
ancillas are prepared using different encoding circuits, shown in Figure 4 and Table 1. 



encoded |0) ancillas and as few as 297 CNOT gates. One of tliese circuits is specified by Figures 3 
and 4, and Table 1. 

The overliead required to prepare a fault-tolerant ancilla depends on the probability that any 
errors are detected. Table 2 shows estimates of the probability that all of the verification stages 
accept along with the corresponding expected resource requirements for the different verification 
circuits. For depolarizing noise rates near p = 10~^, our circuits reduce both the expected number of 
qubits and the expected number of CNOT gates by roughly a factor of four over the twelve-ancilla 
circuit. A more detailed analysis of the acceptance probability and overhead is given in Section 4.2. 

1.2 Code concatenation and the noise threshold 

We consider fault-tolerant, noisy simulations constructed by compiling an ideal quantum circuit 
into a sequence of rectangles, each of which contains an encoded operation and a trailing error 
correction (TEC). Following [AGP06], we define a rectangle to be correct if the action of the 
rectangle followed by an ideal decoder, i.e., a decoder containing no errors, is equivalent to the 
action of an ideal decoder followed by an ideal implementation of the corresponding gate. If a 
rectangle is not correct then it is incorrect. In other words, a correct rectangle effectively acts as an 
encoded version of the intended gate. If all rectangles are correct then a simple induction argument 
shows that the compiled, noisy circuit successfully simulates the original ideal circuit. 

For a fixed stochastic noise model and a fixed quantum error-correcting code, the probability 
that a rectangle is correct is a constant and therefore the probability that all rectangles are correct 
will generally be exponentially small in the number of gates in the circuit being simulated. To 
achieve a constant success probability, a process known as code concatenation [KL96] is often used. 
In a concatenated fault tolerant simulation, each gate is first compiled into a rectangle, called a 
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Figure 4: An optimized circuit for preparing |0) encoded in the Golay code uses 57 CNOT gates applied in 
seven rounds. Gates in the same round are appUed in parallel. The construction is detailed in Section 3.2. 



Ancilla Qubit permutation 

10)2 (20, 0, 11, 19, 8, 4, 15, 12, 22, 18, 16, 2, 14, 7, 1, 10, 9, 3, 21, 5, 13, 17, 6) 

10)3 (14, 10, 11, 13, 15, 7, 12, 3, 19, 20, 8, 22, 16, 18, 6, 1, 2, 21, 4, 0, 5, 9, 17) 

10)4 (12, 0, 10, 11, 17, 3, 1, 19, 8, 6, 18, 20, 4, 2, 14, 7, 13, 9, 22, 5, 15, 16, 21) 



Table 1: The first ancilla in Figure 3 is prepared using the circuit of Figure 4. The other three ancillas are 
prepared in the same way, except with the qubits rearranged according to the above permutations. 



Verification 


Pr [accept] 


E[# qubits] 


min # CNOTs 


E[# CNOTs] 


Steane-12 


0.419 ±0.001 


5183 ± 14.2 


1177 


1782 ± 4.9 


Steane-4 


0.648 ±0.002 


1413 ±3.7 


377 


497.6 ± 1.3 


Overlap-4 


0.633 ±0.002 


1399 ±3.8 


297 


399.4 ± 1.1 



Table 2: Estimates of the acceptance probability and overhead for the twelve-ancilla fault-tolerant ancilla 
preparation circuit and our two optimized circuits, at a depolarizing noise rate of p = 10"'^. The Steane-4 
circuit is based on ancillas prepared according to Table 4. Overlap-4 is based on ancillas prepared according 
to Figure 4 and Tabic 1. The column labeled Pr [accept] gives the probability that all auxiliary ancilla 
measurements in the verification circuit detect no errors. The next column, E[qubits], gives the expected 
number of physical qubits required to produce one verified encoded ]0). This is calculated recursively, by 
computing the expected number of qubits needed to pass each verification step. The last two columns specify, 
respectively, the minimum number of CNOT gates and the expected number of CNOT gates required to 
produce a single verified ancilla. 
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level-one rectangle (1-Rec), as described above. Then, a level-two rectangle (2-Rec) is constructed 
by compiling each physical gate of the 1-Rec into a rectangle. This process is repeated as many 
times as desired. The end result is a circuit composed of a hierarchy of rectangles. 

At each level k of concatenation, the probability that the k-Hec is correct increases relative to 
level A; — 1 so long as the strength of the noise is below a certain value called the threshold. The 
threshold is calculated by upper bounding the probability that each type of rectangle is incorrect. 
In [AGP06] the upper bound is obtained by counting malignant sets of locations inside an object 
called the extended rectangle, or exRec, which consists of the rectangle together with its leading error 
correction (LEG). A set of locations is considered malignant if there exists some fixed combination 
of nontrivial Pauli errors acting on that set of locations that causes the rectangle to be incorrect. 

Malignant set counting works for a broad class of noise models including so-called adversarial 
noise in which locations fail independently at random, but the error at each failing location is chosen 
by an adversary and may be correlated with errors at other failing locations. For more restricted 
noise models such as depolarizing noise, however, malignant set counting is overly pessimistic. 
Roughly, this is because the definition of a malignant set is independent of the underlying noise 
model and, therefore, a large amount of information is ignored. 

In Sections 4.3 and 4.4 we outline a modified malignant set counting technique that more 
accurately computes the threshold for depolarizing noise acting on fault-tolerant simulations 
constructed with our error-correction circuits. Our counting method introduces two new ideas. 
First, for computational efficiency, we break up the exRec into a hierarchy of components and count 
X and Z errors separately to keep the total number of error combinations small. This technique 
allows us to analyze larger subsets of faulty locations than would otherwise be possible. Second, 
we construct at each level a transformed noise model, similar to depolarizing noise, by separately 
accounting for multiple types of malignant events. ExRecs at each level of code concatenation 
behave in a self-similar manner under the transformed noise, thus admitting a straightforward 
threshold calculation. 



The Golay code is a perfect CSS [[23, 1, 7]] quantum error-correcting code (see e.g., [Ste03]). It has 
eleven X and eleven Z stabilizer generators. The code is self-dual, and the X and Z stabilizer 
generators can both be given by the following eleven 23-character strings: 



2 The Golay code 



. 1 . . 1 . .11111 
1 . . 1 . .11111. 
.11.111. . .11 
11.111. . .11. 
1111. . .1. .11 
1.1.1.111. .1 
. . .1111.11.1 
. .1111.11.1. 
.1111.11.1. . 



1 



1 



1 



1 



1 



1 



1 



. 1 
1 . 




1111.11.1. . . . 
1.1. . 1 . .11111 



1 



6 



Here, the Is in a row either ah indicate Z operators or ah indicate X operators, and dots indicate 
identity operators. For example, the first hne indicates that 1®Z®1®1®Z®---®Z and 
1®X(S)1®1®X®---®X are stabihzers. Note that each stabihzer generator has weight eight. 
We index the qubits left to right, from to 22. 

The stabilizer generators partition the group of Pauli errors on 23-qubits into 2^^ cosets. In 
particular, there are 2^^~^^ = 2^^ inequivalent X errors (tensor products of X and /) and 2^^ 
inequivalent Z errors (tensor products of Z and /). 

The Golay code is preserved by qubit permutations in a symmetry group known as the Mathieu 
group M23. This is a four-transitive group of order 23 • 22 • 21 • 20 • 48. It is generated by a cyclic 
shift, and by the permutation (2, 16, 9, 6, 8)(3, 12, 13, 18, 4)(7, 17, 10, 11, 22)(14, 19, 21, 20, 15), in cycle 
notation. 

3 Ancilla preparation and verification 

Our error-correction circuits require multiple encoded |0) and |+) states. The Golay code is self-dual, 
so encoded |+) is prepared by taking the dual of the |0) circuit in the natural way (i.e., swapping 
|0) and 1+) and reversing the direction of each CNOT gate). There are many possible ways to 
encode |0). Our most efficient preparation circuit is shown in Figure 4, and prepares encoded |0) in 
the Golay code with a total of 57 CNOT gates. This circuit provides an efficient means of preparing 
encoded ancillas, but it is not fault-tolerant on its own. 
We define strict fault-tolerance as follows: 

Definition 3.1. An ancilla encoded into a code with distance d is strictly fault-tolerant if for all 
k < [(^72], any error of probability order k propagates to an error of weight at most k. 

The circuit in Figure 4 is clearly not strictly fault-tolerant because, for example, with first order 
probability a faulty CNOT gate may produce an error of weight two when an X-error occurs on 
both its control qubit and its target qubit. We call this error, and any other for which the weight of 
the resulting error is larger than the probability order with which it occurs, "correlated". 

To achieve strict fault tolerance, additional encoded ancillas are prepared. Errors from the 
"target" ancilla are copied onto the additional ancillas which are then measured. If no errors are 
detected, the ancilla is accepted and may be used for error correction on the data. Otherwise, the 
ancilla is rejected, all of the prepared ancillas are discarded, and the procedure is restarted. In 
Figure 3, two pairs of ancillas are prepared. One of the ancillas from each pair is checked for X 
errors. If neither check detects an error, then one of the two remaining ancillas is used to check the 
other for Z errors. 

Care must be taken in preparing the additional ancillas, however. For example, say that two 
encoded ancillas are identically prepared. Assume that a single failure occurs in the first ancilla and 
propagates through the preparation circuit to produce a weight three error. Then the same single 
failure in the other ancilla will produce the same weight three error. When the error from the first 
ancilla is copied to the second, the two errors will cancel each other and no error will be detected. 
This is a second order event that results in a weight-three error. 

Therefore, we seek to prepare encoded ancillas that produce different correlated error sets. In 
this section we provide two related methods for constructing fault-tolerant ancillas encoded in the 
Golay code using the circuit in Figure 3. In Section 3.1 we analyze the correlated errors produced by 
preparation circuits constructed with the standard Latin rectangle method and provide a randomized 
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Weight: 
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2 


3 


4 


5 


6 


7 


Number of X errors: 


1 


23 


253 


1771 


1771 


253 


23 


1 


Number of Z errors: 


1 


23 


253 


1771 















Table 3: The number of errors on Golay encoded |0) by Hamming weiglit. All Z errors are correctable so 
there are no Z errors of weight greater than three. 



method for finding ancillas with different correlated error sets. In Section 3.2 we describe a new 
preparation circuit specific to the Golay code and again provide a randomized method for finding 
ancillas with different correlated error sets. 

3.1 Randomized method for preparing encoded |0) 

The standard method for preparing encoded states for CSS stabilizer codes, including the Golay 
code, is to construct and solve a partial Latin rectangle based on the stabilizer generators [Ste02]. 
To prepare |0) in the Golay code, consider the eleven stabilizer generators that are tensor products 
of Pauli X operators. These stabilizer generators form an 11 x 23 binary matrix in which the X 
operators in the tensor product are represented as Is, as in Eq. (2.1). Gaussian elimination is 
performed until the matrix is of the form 

11 12 

ii{("?^|^) (3.1) 

The first eleven qubits, called "control" qubits, are prepared as |+), and the remaining "target" 
qubits are prepared as |0). The matrix A represents a partial Latin rectangle, the solution to which 
is used to schedule rounds of CNOT gates from control to target qubits. 

An X error in the preparation circuit can propagate to other qubits only if it occurs on a control 
qubit, and then only through the X stabilizer being created from that control qubit. Thus single 
faults can create up to 22 weight-two errors (for each of the eleven X stabilizers, either IIIIIIXX or 
IIXXXXXX ~ XXIIIIII), 22 weight-three errors and eleven weight-four errors [IIIIXXXX 
for each stabilizer). 

A single X fault, i.e., a fault resulting in an X error, cannot break the verification circuit in 
Figure 3. If it creates a correlated error on the first ancilla, that error will be detected on the second 
ancilla, and both will be discarded. Four or more X faults also cannot break our the verification 
circuit because we only seek fault tolerance up to order three. 

Two X faults can break the verification circuit only if there is one failure in each ancilla 
preparation that propagates to an error of weight at least three — necessarily the same error so 
that it is undetected. To obtain a crude estimate for how likely this is to occur, pretend that the 
correlated errors created by a random preparation circuit are uniformly distributed among all errors 
of the same weights. The number of errors on encoded |0) for each weight are given in Table 3. 
Then the probability that two preparation circuits share no such correlated errors is estimated as 



1771-22 \ (' 1771-11' 
22 / V 11 . 



0.71 



Three X errors can break the circuit if they lead to an undetected error of weight four or greater 
on the first ancilla. Consider the case that there are two failures while preparing the first ancilla and 
one failure while preparing the second ancilla. The number of different weight-four errors created 
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Table 4: Four seven-round ancilla-preparation schedules. In each table, the entry in row z, column j specifies 
the target qubit of a CNOT gate with control qubit i applied in round j. Using these schedules in the 
verification circuit of Figure 3, the output encoded |0) state is fully fault-tolerant against both X and Z errors. 

with second-order probability (i.e., excluding those created with first-order probability) depends 
on the circuit. For ten random circuits, the smallest count we obtained was 688 and the largest 
735, with an average of 711. Using this average value, we estimate that the probability of a random 
circuit succeeding against three X errors is roughly [( 1771^711 ^ ^ ^ 1771 ^ ^ 2 . 10^^. (Here the 
square is because we want the circuit to work against both the case of two failures in the first ancilla, 
one failure in the second, and vice- versa.) Overall, we expect to have to try about 1.2 • 10^ random 
pairs of preparation circuits before we find one that gives fully fault-tolerant X-error verification. 

The result of X-error verification is a single ancilla free of correlated X errors up to weight-three, 
but possibly containing correlated Z errors. The Z-error propagation can be analyzed in a manner 
similar to that used for X errors. A single failure in an X-error verified ancilla can produce roughly 
60 Z errors of weight three. Again assuming a uniform distribution, the probability of finding two 
X-error verified ancillas that share no correlated Z errors of weight three is ( ^'^^go~^'^) / ( ^qq^ ) ~ 0.12. 
In total, we expect to try about five X-error fault-tolerant pairs in order to find two pairs that are 
fully fault-tolerant for both X-error and Z-error verification, as ( I ) = 10. 

To find fault-tolerant verification circuits in this way, one needs to be able to generate sufficiently 
random preparation circuits. As the Latin rectangle procedure for finding encoding circuits is 
fully algorithmic, it can be randomized by starting with a random presentation of the Golay code. 
Alternatively, one can begin with a fixed encoding circuit and randomly permute the seven rounds 
of CNOT gates (all of the CNOTs commute), or permute the qubits according to a random element 
of the symmetry group M23. By trying roughly 10^ random pairs, we found 14 pairs of ancillas that 
were fully fault-tolerant against X errors. Of the ( 2^ ) combinations, six were also fully fault-tolerant 
against Z errors. Table 4 presents one such set. 

3.2 Overlap method for preparing encoded |0) 

The above procedure for finding a fault-tolerant verification circuit uses ancilla preparation circuits 
constructed from the Latin rectangle method. We now show an alternative construction based on a 
modification of the Latin rectangle method. By carefully analyzing the stabilizer generators of the 
Golay code we can reduce the number of CNOT gates required to prepare encoded |0). 

To explain the optimization, first consider the Steane [[7, 1,3]] code. A Latin rectangle-based 
encoding schedule, shown in Figure 5(a), needs nine CNOT gates. An equivalent circuit requiring 
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Figure 5: Two alternative circuits for preparing encoded |0) in the Steane code, a self-dual code with X 
stabilizers IIIXXXX, IXXIIXX and XIXIXIX. The circuit in (a) follows Steane's Latin rectangle 
encoding method. The circuit in (b) prepares the same state using one fewer CNOT gate. The new CNOT 
gate has the same effect as the two removed gates. 



X-error weight: 
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Order 1: 


16 


14 
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Order 2: 




493 


400 


35 


2 






Table 5: Correlated X-error counts for the encoded |0) circuit in Figure 4. 



only eight CNOT gates is shown in Figure 5(b). This circuit removes two of the CNOTs for which 
qubit six is a target and replaces them with a single CNOT from qubit five to qubit six in round 
three. This works because in 5(a) qubits five and six are both the targets of CNOTs from qubits 
one and three; the corresponding stabilizer generators overlap on qubits five and six. 

The same technique of exploiting overlap between stabilizers extends to larger CSS codes. For 
the Golay code, Figure 4 gives an encoding circuit with only 57 CNOT gates, 20 fewer than given 
by the Latin rectangle method. 

By reducing the number of CNOT gates, this circuit also reduces the number of correlated 
errors. For example, a single failure in the Latin rectangle encoded circuits can cause up to 22 
weight-two errors, but a single failure in the new circuit can only cause up to 16 weight-two errors. 
The correlated error counts for first and second order are shown in Table 5. The smaller number 
of correlated errors means that it should be easier to find fault-tolerant circuits by randomization. 
However, unlike Steane schedules the overlap schedule depends on a fixed code presentation and on 
a fixed round ordering, since the CNOT gates do not commute. 

To obtain randomized overlap method encoding circuits, we use the permutation symmetry of 
the Golay code and permute the qubits of Figure 4 according to a pseudo-random element of the 
symmetry group M23. By analyzing the correlated error sets of randomly permuted circuits, we 
have found many sets of fault-tolerant four-ancilla preparation circuits. In fact, we have even found 
sets for which the order required for a weight-/c error to pass verification is at least k + 1 (rather 
than k) for all k <2. This reduces, for example, the probability of accumulating an uncorrectable 
error on the data block by first a weight-two error in Z-error correction and then another weight-two 
error in X-error correction. One such set of four permutations is given in Table 1. 
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4 Overhead and threshold analysis 



The remainder of this article focuses on analyzing the overhead and noise threshold for fault-tolerant 
quantum computation using the Golay code ancilla preparation and verification circuits from 
Section 3. Our overhead analysis, in Section 4.2, is based on Monte Carlo computer simulations with 
a depolarizing noise model. Our threshold analysis relies on a malignant set counting technique that 
is tailored for the same depolarizing noise model. The counting technique is outlined in Section 4.3 
and proof of the threshold lower bound is presented in Section 4.4. (Some details are given in the 
appendices.) Threshold calculation results for our circuits are discussed in Section 4.5. 

4.1 Noise model 

We begin by defining the depolarizing noise model, a standard model used before in, e.g., [Kni04b]. 
We study noisy circuits constructed from the following physical operations: |0) and |+) initialization, 
a CNOT gate, and single-qubit measurement in the Z and X eigenbases. Every qubit in the 
computer can be involved in at most one operation per discrete time step. CNOT gates are allowed 
between arbitrary qubits, without geometry constraints. Resting qubits are also subject to noise. 

Definition 4.1 (Independent depolarizing noise with parameter 7). Noisy operations are modeled by: 

1. A noisy CNOT gate is a perfect CNOT gate followed by, with probability j|7, the simultaneous 
depolarization of the two involved qubits. Equivalently, after applying the ideal CNOT gate, 
with probability I57 a non-trivial two-qubit Pauli error drawn uniformly and independently 
from {I, X, Y, Z}®^ \{I(g)I} is applied. 

2. Noisy preparation of a |0) state is modeled as ideal preparation of \0), followed by application 
of an X error with probability 47. Similarly, noisy preparation of |+) is modeled as ideal 
preparation of |+) with probability 1 — 47 ^.nd of | — ) = Z\+) with probability 47. 

3. Noisy Z -basis (\0),\1)) measurement is modeled by applying an X error with probability 47, 
followed by ideal Z -basis measurement. Similarly, noisy X -basis (\+),\—)) measurement is 
modeled as ideal measurement except preceded by a Z error with probability 47. 

^. A noisy rest operation is modeled as applying either the identity gate, with probability 1 — I27, 
or with probability 47 each, one of the Pauli errors X, Y or Z . 

All locations fail independently of each other. Let p = I57, the probability for a CNOT gate to fail. 

To justify this noise model, note that the noise on a resting qubit is the one-qubit marginal of 
the CNOT gate noise. The noise rate for preparation and measurement is lower, only 47, because 
any higher noise rate could be reduced to 47 + 0(7^) by repeating the preparation or measurement 
operation using two qubits coupled by a CNOT. 

During error counting, X and Z errors are usually considered separately and the error probability 
is computed by omitting the Z 01 X part of each error, respectively. For example, when considering 
only X errors XY is equivalent to XX, XZ is equivalent to XI and so on. Thus, the marginal 
distribution of X errors for a CNOT gate applies with probability I27 a uniformly random error 
from {IX, XI, XX}. Similarly, for Z errors, the marginal error distribution applies a random error 
from {IZ, ZI, ZZ}. For preparing |0) or measuring in the Z basis, no Z errors are possible, and 
similarly no X errors are possible for preparing |+) or measuring in the X basis. The marginal X- 
and Z-error distributions for a rest are to apply X ox Z errors with probability 87. 
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(a) 



(b) 



Figure 6: Overhead for the twelve-ancilla ancilla preparation and verification circuit and for each of our 
optimized circuits, (a) Expected number of CNOT gates required to produce a verified encoded |0). (b) 
Number of qubits required to produce one verified encoded |0), in expectation, at every time step. Standard 
error intervals are too smah to be seen here. 



4.2 Simulation of the overhead 

To evaluate the practical importance of our optimizations, we now analyze the resource requirements 
of our ancilla preparation and verification circuits. One natural measure for this overhead is the 
number of CNOT gates used to ready an ancilla. Another overhead measure, important given the 
difficulty of scaling quantum computers, is the space complexity, i.e., the number of qubits that 
must be dedicated to ancilla preparation in a pipeline so that an ancilla is always ready in time for 
error correction. We consider both measures. 

As listed in the third column of Table 2, the overlap method-based four-ancilla preparation 
and verification circuit involves roughly a factor of four fewer CNOT gates than the standard 
twelve-ancilla circuit. In fact, this understates the improvement. The overhead also depends on 
the acceptance rates of each verification test. For an ancilla to leave the twelve-ancilla circuit, it 
must pass eleven tests, compared to only three tests for the four-ancilla circuit. The probability of 
passing all tests should be significantly higher for the optimized circuit, and so one expects the ratio 
between the expected numbers of CNOT gates used by the two circuits to be greater than four. 

To estimate the expected overhead, each circuit was modeled and subjected to depolarizing noise 
in a Monte Carlo computer simulation. We assumed that test results are available soon enough that 
a failed verification circuit can be immediately aborted; later test failures are therefore the most 
costly. This assumption impacts the twelve-ancilla circuits the most, since there are many ways to 
construct the hierarchy of verifications. The circuit shown in Figure 2 is a reasonable choice here 
because only six of the verification tests depend on results of previous tests. Other circuits may 
contain as many as nine dependent tests. 

Estimates of the expected number of CNOT gates required for each circuit are given in the last 
column of Table 2 for CNOT depolarization rate p = 10~^, and are plotted versus p in Figure 6(a). 
At p = 10~^, the overlap method reduces the expected number of CNOT gates by roughly a factor 
of 4.5, compared to the twelve-ancilla circuit, and the improvement for our optimized Latin rectangle 
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scheme is a factor of about 3.6. At lower error rates, the improvement is less. To investigate the 
effects of different error parameters, we also considered setting the rest error rate to zero; in this 
case, the expected number of CNOT gates used in the overlap circuit further decreases by about 11 
percent, compared to less than four percent for our other four-ancilla circuit and less than two 
percent for the twelve- ancilla circuit. The larger improvement for the overlap circuit is due primarily 
to the fact that the overlap preparation method replaces many CNOT gates with rest locations. 

To evaluate the space overhead, we plot in Figure 6(b) the number of qubits required to produce a 
single verified encoded |0), in expectation, per time step, for each of the preparation and verification 
circuits. Thus, for example, the space overhead for a pipeline to produce a single unverified ancilla 
state is 8 • 23 = 184 qubits; at any given time step, one 23-qubit block is initialized, and CNOT 
gates are applied to seven other blocks — one per round in, e.g.. Figure 4 — so that one ancilla is 
prepared. (In fact, the overhead is slightly less than this since some of the qubits in the block 
can be prepared during rounds one and two.) Estimates are calculated recursively by computing 
E [qubits] = (E [qubits] i + E [qubits] 2 )/Pr [accept] for each verification step where the numerator is 
the expected number of qubits required required to prepare the two states used in that verification 
step and Pr[accept] is the probability that the verification measurement detects no errors. The 
results at p = 10~^ are given in the second column of Table 2. Both of our optimized schemes 
reduce the required space by a factor of roughly 3.6 at p = 10~^. 

To judge the significance of these results, we remark again that the ancilla production pipeline can 
consume the majority of resources in a fault-tolerant quantum computer. In the case of [IWPK08], 
physical ancilla production space is proportional to the number of CNOT gates in the pipeline. A 
factor of 4.5 reduction in the CNOT overhead for ancilla preparation should give, very roughly, 
about a 50 percent improvement in the total footprint of the quantum computer. 

4.3 Counting malignant sets 

As we have shown, our two optimized ancilla preparation and verification circuits significantly reduce 
the overhead required for fault-tolerant ancilla preparation. We would also like to know how these 
circuits impact the tolerable noise threshold. With fewer verification stages our ancillas are slightly 
more likely to contain errors and so one might expect a lower noise threshold when compared to 
previous verification circuits. On the other hand, the smaller size of our circuits makes it easier to 
give a tighter analysis. 

The threshold calculation is most limited by the exRec with the largest number of locations. The 
Golay code admits transversal implementations of encoded Clifford group unitaries. Universality 
can be achieved by injection and distillation [BK05, Kni04b], which involves only Clifford group 
unitaries, and the single-qubit preparations and measurements that are already assumed by our 
model. Therefore the largest exRec in our case is for the encoded CNOT gate, an exRec that 
consists of four Steane-type error corrections plus 23 CNOT gates (see Figure 7). Table 6 gives a 
breakdown of the number of locations for our preparation circuits, and the total number of locations 
in the CNOT exRec. 

Monte Carlo simulations of circuits using the Golay code [Ste03, CDT09] indicate that the 
depolarizing noise threshold should be on the order oi p = 10~^. Unfortunately, it is not straightfor- 
ward to prove such a high threshold using malignant set counting. For example, say that we check 
for malignancy all location subsets of size up to fcgood) and we assume that all larger subsets are 
malignant. Then the estimate we obtain for the probability of an incorrect rectangle is at least 
J2k=k +1 a)P^i^ — p)"~'^. For n = 5439 locations and p = 10~^, this term drops below 10~^ 
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Figure 7: Organization of a CNOT extended rectangle, or "exRec." (a) Tire CNOT exRec includes four 
error corrections, two leading (LEG) and two trailing (TEC), and a transversal CNOT gate, (b) Each 
error-correction component consists of separate Z and X error corrections. Z-error correction requires a |0) 
state that has been verified against errors, and X-error correction requires a verified 1+) ancilla state, (c) A 
verified |0) state is prepared by checking two pairs of prepared |0) states against each other for X errors, 
then, conditioned on no X errors being detected, checking the results against each other for Z errors. Verified 
1+) is prepared by taking the dual of the |0) circuit. These components are discussed, in reverse order, in 
Sections 4.3.2 to 4.3.5. 



only for kg^od ^ 14. However, there are more than 10 subsets of size at most 14, so checking them 
one at a time is computationally intractable. 

Instead of checking each set for malignancy, one can sample random sets of locations in order to 
estimate the fraction that are malignant. This technique, called malignant set sampling, can provide 
threshold estimates with statistical confidence intervals. However, both malignant set counting 
and sampling techniques study the threshold for worst-case adversarial noise, and may be overly 
conservative for a more physically realistic, non-adversarial noise model such as depolarizing noise. 
For example, malignant set sampling results from [AC07] estimate a threshold of only p « lO"'^ for 
the Golay code. 

We therefore present an alternative to malignant set counting that is tailored to circuits based on 
the Golay code and depolarizing noise. Roughly, we divide the exRec into a hierarchy of components 
and sub-components. We then compute an upper bound on the probability of each error a component 
may produce, essentially by checking location sets up to a certain small size. At the exRec level, we 
synthesize the component error bounds into upper bounds on the probability that the rectangle is 
incorrect. The resulting error probabilities are treated as an effective transformed noise model for 
the encoded circuit. With some care, the transformed noise model can be fed recursively back into 
the procedure to determine an effective noise model for the next level of encoding, and so on. 



14 





Location type 






0) preparation circuit 


CNOT Prep. Meas. Rest 


Total 


CNOT exRec total 


Steane 


77 23 6 


106 


5439 


Overlap 


57 23 38 


118 


5823 



Table 6: Location counts for preparing encoded |0) in the Golay code. Encoded |0) ancillas are prepared 
with either the pseudorandomly constructed Steane preparation circuits (Table 4), or the overlap preparation 
circuits (Figure 4 and Table 1). The last column shows the total number of locations inside the CNOT exRec 
shown in Figure 7, including the transversal CNOT operation and four error corrections. 
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Figure 8: A circuit component with input error (xin,Cin) and output error (xout,Cout) 



Effectively, dividing the exRec into components allows us to efficiently account for even very 
large location subsets. Most large sets will be roughly evenly divided, with only a small number of 
locations in each component. 

The remainder of this section outlines our modified malignant set counting technique. Details of 
the threshold analysis are given in Section 4.4. 



4.3.1 Characterizing exRec components 

We will divide the exRec into its encoded operation and its error corrections. The error corrections 
will each divide into X-error correction and Z-error correction, and further recursive divisions will 
continue until reaching the physical location level. 

Each component in the hierarchy has input error (xin; Cin), some number of internal failures 
and output error (XoutiCout) which depends on the internal failures and on the input error (see 
Figure 8). For every error equivalence class on the inputs and outputs and for every /c G N, we 
would like to compute 

Pr [(Xout, Cout) = (a;out, ^out), K = k\ (Xm, Cin) = {Xin, ^in)] , (4.1) 

the probability that there are exactly k failures and the output error is (xout^-^out) conditioned 
on the input error (xjni^in)* Here, the notation (x, ^) indicates an error equal to the product xz 
where x is a tensor product of X and / operators and z is a tensor product of Z and / operators. 

For components that are physical gate locations the probability in (4.1) is defined by the 
depolarizing noise model (Definition 4.1). Larger components are analyzed by first analyzing each 
enclosed sub-component. At the exRec level the LEC, transversal CNOT and TEC components 
provide all of the information necessary to determine the probability that the exRec is incorrect. 
Indeed, we shall see in Section 4.3.5 that they contain enough information to compute the probability 
for each way that the exRec can be incorrect. 

There are, however, two logistical problems. First, on each 23-qubit code block, there are 2^^ 
inequivalent X errors and 2^^ inequivalent Z errors, and thus 2^^^ inequivalent Pauli errors total. 
(For example, there are 2^^ different tensor products of X and / operators, and the group of X 
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stabilizers has size 2^^, leaving 2^^ X-error equivalence classes.) For a component involving two code 
blocks, this means we should compute for each k up to (2^^)^ quantities, one for each combination 
of input and output errors. Second, since there are ( ^ ) size-fc subsets of n locations and since each 
CNOT gate has 15 different ways to fail, a computation that accounts for all possibilities scales 
roughly as (^) 15^^. Such a computation is feasible only for small k and small n. 

The first problem can be solved by observing that in Steane error correction X errors and Z errors 
are corrected separately. Furthermore, there are no Hadamard gates or other ways of transforming 
an X error into a Z error, or vice versa, so X and Z errors mostly propagate independently. X and 
Z errors cannot be treated independently entirely, because X and Z failures are highly correlated 
in the depolarizing noise model, and the postselection steps in ancilla verification could amplify any 
initial dependencies. Still, for most components, the X-error part of the output of a component 
depends only on the X-error part of the input and the X failures that occur inside the component. 
A similar observation holds for Z errors. Thus, expression (4.1) may be split into separate X and Z 
parts: 

Pr[xout = a^out, Kx = k\xm = Xin] (4.2a) 
Pr[Cout = ^^out, Kz = k\Ci^ = Zin] . (4.2b) 

Here, the random variable Kx is the number of failures inside the component that contain an 
X when decomposed into a tensor product of Pauli operators. The value Kz is similarly defined 
for Z. When considering X and Z errors separately, the input and output of a two-block component 
contain at most 2^^ inequivalent errors and the worst case combination is a large but manageable 
2^® cases. 

The second problem is eliminated by noting that, for a fixed k, the probability of an order-A; 
fault decreases rapidly as the size of the component decreases. For example, for p = 1 x 10^^, the 
probability of an order-ten fault in the exRec is about 0.027. However, the probability that all ten 
failures are located in a single error correction is only about 1.4 x 10~^. Thus there is little gain in 
counting errors or order-ten or higher in the error correction component. 

In general, the probability that a component contains a fault of order greater than /cgood can be 
bounded according to 

n 

Pr[K > A:good] < E ( ^ ) (1 - pT-V ■ (4.3) 

(A tighter bound can be achieved by considering separate k for each location type. See Appendix A.l.) 
We will choose a value of fegood for each component and then pessimistically assume that all faults 
of order greater than /cgood within the component cause the rectangle to be incorrect. For large 
enough values of A;good the overall impact on the threshold is negligible. There is a tradeoff here 
between running time and accuracy. A larger value of /cgood yields a more accurate bound on the 
probability that the rectangle is incorrect. A smaller value of /cgood is easier to compute. We must 
choose for each component a suitable A:good that balances the two. 

In the end we are left with two sets of faults for each component, those of order at most fcgood 
and those of order greater than /cgood- Each fault in the first set is counted to obtain accurate 
estimates of (4.2a) and (4.2b). When a fault from this set occurs we call it a good event. Faults in 
the second set are not counted and are instead bounded using (4.3) and pessimistically added to 
the final incorrectness probability bounds for the exRec. When a fault from this set occurs we call 
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it a bad event. The probability that the rectangle is incorrect is then upper-bounded by 



Pr[incorrect] < Pr[incorrect, good] + Pr[bad] . 



In general, there are four quantities we need to upper bound for each component: 
Pr[xout = Xout,Kx = k,goodx\Xm], Pr[Cout = Zont,Kz = k,goodz\Cm], Pr[badx], and Pr[bad2] . 

The event good^ = -ibadx occurs when there is a set of X-error failures in the component that 
we choose to count. It will usually depend only on fcgood in which case good^^^ (Kx < ^good)- In 
some cases goodjjf may depend on a vector k representing the number of X-error failures across 
multiple sub-components. The event good^ = -ibad^ is similarly defined for Z. 

In the remainder of this section we outline the procedure for computing the above quantities for 
each component of the CNOT exRec. A more precise analysis is presented in Appendix A. 



4.3.2 X-error verification 

X-error verification requires two encoded |0) states. The first is verified against the second for X 
errors by applying transversal CNOT gates between the two code blocks and then measuring each 
qubit of the second block in the Z eigenbasis (|0), |1) basis). Conditioned on no X errors being 
detected, the first code block is accepted. See Figure 7(c). 

Letting accept denote the event that no X errors are detected, we use Bayes's rule 

Pr[event|accept] = "^^'^p^^^^^^^^'^ (4.4) 

to compute the conditional probabilities of different error events. For an event x involving only X 
errors, this calculation is straightforward. 

However, if the event is a Z error (, then the numerator Pr[C = z, accept] is difhcult to compute 
as it mixes X and Z errors. The obvious bound, Pr[(^ = z, accept] < Pr[C = z], is quite pessimistic 
because in the depolarizing noise model we expect X errors to occur with Z errors roughly half 
of the time, and so X-error verification should remove many Z errors. It is important to obtain 
an accurate count of Z errors since they strongly influence the acceptance rate of the upcoming 
Z-error verification. Therefore, we also count X and Z errors together for very low-order faults and 
apply a correction to the Z-only counts. Details of the correction are worked out in Appendix A. 2. 



4.3.3 Z-error verification 

Z-error verification is similar to X-error verification. However, as shown in Figure 7(c), we add a 
pause, i.e., transversal rest operations, to allow the preceding X-error postselection to complete. 

Similar to X-error verification, all events are now conditioned on the event accept of no Z errors 
being detected. When considering an X-error event X: we generally use the pessimistic inequality 
Pr[x = X, accept] < Pr[x = x]. This inequality is less of a problem than the similar inequality 
Pr[C = z, accept] < Pr[(^ = z] we encountered during X-error verification, for two reasons. First, 
many X errors have already been eliminated, so the probabilities start out much lower. Second, 
overestimating the probability of an X error now is less serious; since there are no remaining 
postselection steps, the distribution of errors will not need to be renormalized again. Even so, we 
count X and Z errors together for very low-order faults, since it is relatively easy to do so. 
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4.3.4 Error correction 

An error-correction component consists of Z-error correction and X-error correction, as shown 
in Figure 7(b). Each sub-component begins with a pause on the input verified ancilla state, to 
allow for the previous postselection to complete. After extracting the error syndrome, the lowest- 
weight correction is computed, and this correction is applied by a change in the qubits' Pauli 
frames [Kni04b]. 

There are two types of error correction components, leading error correction (LEG) and trailing 
error correction (TEC). For the LEG, we may assume that the input errors Xin and are both 
zero. This because the probability that the rectangle is incorrect depends only on the syndrome of 
the output of the LEG and that syndrome depends only on the errors inside of the LEG [GDT09]. 
That is, we do not care about the logical state at the output of the LEG, we care only that it is 
correctly manipulated by the rectangle. For trailing error correction, we care only about the result 
of applying a logical decoder to the output. In other words, we only need to know whether the 
output errors Xout and (^out represent correctable errors or not. The four relevant quantities are 



where d G {0, 1} and D[e) identifies whether e is a correctable error (0) or an uncorrectable error 
(1). That is, D{e) = 1 if and only if e decodes to a nontrivial Pauli error. 

4.3.5 exRec 

The CNOT exRec, shown in Figure 7(a), is divided into five components: two leading error 
corrections, a transversal GNOT, and two trailing error corrections. At this level, we are interested 
in malignant events — the events for which the rectangle is incorrect. More specifically, when a 
malignant event occurs we would like to know how the rectangle is incorrect. 

Let iV'i) be the two-qubit state obtained by applying ideal decoders on the two blocks of the GNOT 
immediately following the LECs. Similarly let be the state obtained by applying ideal decoders 
immediately following the TEGs. Then define mal/x as the event that {I X)Ucnot\''pi) = IV'2), 
where Ucnot is the two-qubit unitary corresponding to the ideal GNOT gate. Similarly define the 
events malx/, malxx, mal/^, malzi, malzz- The event mal^; can be informally interpreted as the 
event in which the rectangle introduces a "logical" error E. 

The relevant quantities are Pt[Mx, Kx = /c, good] and Pt[Mz,Kz = A;, good] for Mx € 
{mal/x, malx/, malxx} and Mz G {mal/^, mal^/, mal^z}- Since we count X and Z errors sepa- 
rately, it is not possible to compute logical Y error quantities. Intuitively this is not a great loss, 
because the correlations between X and Z are much smaller at this level. In the next section we 
show how to use these quantities to compute a lower bound on the threshold for depolarizing noise. 

4.4 Calculating the error threshold 

As discussed in Section 1.2, the standard way of calculating the asymptotic error threshold involves 
finding subsets of faulty exRec locations (called "malignant") for which some combination of Pauli 
errors at those locations causes the enclosed rectangle to be incorrect. Our counting method is 
different. We count subsets of faulty locations, but the counted information is synthesized into error 
probability upper bounds based on a particular noise model and error correction scheme. 



Pr[xout = a^out, Kx = k, good|xin = 0] 
Pr[Cout = Zont,Kz = A;,good|Cin = 0] 



Pr[i:'(xout) = d,Kx = A;,good|xin = xin] 
Pr[Z:>(Cout) = d,Kz = k,good\Cin = ^m] 
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In this section we outline an alternative method for rigorously lower bounding the noise threshold 
that is tailored specifically to the information obtained by our counting procedure. The basic idea is 
to treat each level-one rectangle in the level-two simulation as a single "location" with a transformed 
noise model based on the malignant event upper bounds obtained in Section 4.3. In particular, we 
show how to treat each level-one exRec independently while maintaining valid upper bounds on the 
error probabilities. 

4.4.1 Calculating the pseudo-threshold 

One quantity that is particularly easy to calculate from our counts is the so-called pseudo- 
threshold [SCCA06] for the CNOT location. The pseudo-threshold for location / is defined as 
the solution to the equation p = p\^\ where is the probability that the 1-Rec for location / is 
incorrect. We may compute a lower bound on the pseudo-threshold for CNOT by upper bounding 

Pinot < Pr[bad|accept] + ^ ( Pr[malx, i^x = k, good] + Pr[malz, Kz = k, good]) , (4.5) 

k 

where malx = (mal/x V malx/ V malxx), mal^ = (mal/^ V malzi V malzz) and accept is the event 
that all X-error and Z-error verifications in the CNOT exRec succeed. 

The pseudo-threshold is is of practical interest for cases in which a finite failure probability is 
acceptable and only a few levels of concatentation are desired. For example, when the physical 
failure rate is sufficiently below the pseudo-threshold, the Golay code could be used to bootstrap 
into other codes with lower overhead. 

The pseudo-threshold is useful to us for two reasons. First, pseudo-threshold estimates have 
been calculated for a variety of fault-tolerant quantum circuits including circuits based on the Golay 
code [CDT09] , and therefore serve as a reference for our counting results. Second, it was conjectured 
by [SCCA06] that the pseudo-threshold is an upper bound on the asymptotic threshold. It thus 
provides a reasonable target for our calculation of the asymptotic threshold lower bound, which 
requires a noise strength maximum to be specified (see, in particular. Appendix D.2). 

4.4.2 Asymptotic threshold analysis 

The asymptotic noise threshold is defined as the largest value 7th such that, for all 7 < 7th, the 
probability that the fault-tolerant simulation succeeds can be made arbitrarily close to one by using 
sufficiently many levels of code concatenation. To prove a lower bound on the threshold we must 
show, in particular, that the probability of an incorrect CNOT A;-Rec decreases monotonically with k 
for all 7 < 7th. Our counting technique gives an upper bound on the probability that a CNOT 
1-Rec is incorrect. We now show how to upper bound incorrectness for level- two and higher and 
therefore lower bound 7th. 

Consider an isolated level-one CNOT exRec. Let Pr[mal£;] be the probability that the malignant 
event malg occurs. For this event, the enclosed 1-Rec behaves as an encoded CNOT gate followed by 
a two-block error that, when ideally decoded, leaves a two-qubit error E on the decoded state. Then 
our counting technique provides upper bounds on Pr[mal£;] for E E {IX, XI, XX, IZ, ZI, ZZ}. 
These upper bounds can be viewed as an error model for the CNOT 1-Rec in which the correlations 
between X and Z errors are unknown. 

We would now like to analyze the level- two CNOT exRec. Ideally, we could treat each 1-Rec 
in the level-two simulation as a single "location" and use the error model obtained from level- 
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Figure 9: Overlapping exRecs: exRec 1 shares one error correction with exRec 2 and one error correction 
with exRec 3. 



one to describe the probabiHty of failure. Then level-two analysis could proceed by feeding this 
"transformed" error model back into the counting procedure in order to compute Pr[mal£;] for the 
CNOT 2-Rec. 

However, the transformed error model is based on analysis of an isolated level-one CNOT exRec. 
A typical level-one simulation will contain many exRecs, and adjacent exRecs may share error 
corrections at which point they can no longer be considered independently. For example, the 
CNOT exRec in Figure 9 shares an error correction with both of the CNOT exRecs that follow 
it. In [AGP06] (see also [Ali07]) this problem is solved by the following procedure known as level 
reduction: 

1. Examine exRec 2. If the enclosed rectangle is incorrect then replace the entire exRec with a 
faulty version of the associated (level-zero) gate. Otherwise, replace the rectangle with an 
ideal version of the associated gate. 

2. Examine exRec 3. Follow the same procedure as for exRec 2. 

3. Examine exRec 1. Depending on the outcomes of exRec 2 and exRec 3, one or both of the 
TECs may have been removed. The enclosed rectangle now consists of the encoded CNOT 
and any remaining TECs. If the remains of rectangle 1 are incorrect, exRec 1 is replaced with 
a faulty level-zero gate. Otherwise, the rectangle is replaced with an ideal level-zero gate. 

Level reduction allows the level-two analysis to proceed by treating each 1-Rec as a single 
independent location. The probability that a "location" fails in the level-two simulation is upper 
bounded by the probability that the corresponding 1-Rec is incorrect. The reason that level reduction 
works when counting sets of malignant locations is because exRecs with incorrect rectangles are 
replaced with faulty gates in the same way regardless of malignant event that actually occurs. The 
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Figure 10: Upper block of the CNOT exRec. The error at the output of the TEC is either correctable (1), or 
not (X). Similarly the error immediately preceding the TEC is either correctable (I') or not (X'). 



quantity used to bound incorrectness probability is strictly non-increasing as locations (i.e., TECs) 
are removed. To see this, consider sets of exRec locations of size k and denote the set of all such sets 
by S. Let M C 5* be those sets for which some combination of nontrivial errors at the k locations 
causes the rectangle to be incorrect (i.e., the malignant sets). The probability that the rectangle is 
incorrect due to failures at exactly k locations is then no more than |M|p^. If an error correction is 
removed from the exRec, some of the sets in M now contain fewer than k exRec locations. The 
remaining sets with k exRec locations are those that do not contain a location in the removed error 
correction. The number of such sets is at most \M\ and so the original bound on the incorrectness 
probability still holds. 

The disadvantage to this approach for non-adversarial noise models is that it fails to consider 
all of the available information. In particular, for a fixed set of malignant locations it assumes 
the worst-case error for each location. The probability that a given set of k locations is actually 
malignant can be significantly less than p^. To obtain a more accurate analysis of the second level, 
we would like to replace each incorrect 1-Rec according to the malignant event that has actually 
occurred. 

Our transformed noise model of an isolated CNOT exRec provides upper bounds on the 
probability of each type of malignant event, but we must show that that the bounds still hold when 
exRecs overlap. Unfortunately, the bounds almost certainly will not hold. Consider, for example, 
the control block of the CNOT exRec, shown in Figure 10. Assume that the error immediately 
preceding the transversal CNOT is correctable (the error itself is not important). Let X be the event 
that an uncorrectable X error exists on the output of the TEC and I be the event that the error on 
the output is correctable. In other words X = (ma\xi V malxx) and I = -iX. Then define X' = 
as the event that a correctable X error exists on the block following the transversal CNOT but 
before error correction. Pr[malx/] will be non-increasing when removing the trailing error correction 
only if Pr[X'] < Pr[X]. On the other hand, Pr[mal/x] will be non-increasing only if Pr[l'] < Pr[l]. 
Since Pr[X] + Pr[l] = Pr[X'] + Pr[l'] = 1, both conditions are satisfied only if Pr[X] = Pr[X'] and 
Pr[l] = Pr[l'], which of course is highly unlikely. 

In order to ensure a proper upper bound on each of the malignant event probabilities, we must 
calculate upper bounds for the complete exRec and for incomplete exRecs in which one or more 
trailing error corrections have been removed. Calculations for the complete exRec were discussed 
in Section 4.3. Calculations for the incomplete exRecs are the same except that some of the TEC 
components are not considered. Bounding the malignant event probability is a matter of finding a 
polynomial that bounds all four cases (see Appendix D.2). 

Once proper bounds on the level-one malignant event probabilities are determined, we would like 
to plug the transformed error model into our counting procedure in order to determine the level-two 
error probabilities. There are a few things to consider before doing so. First, part of the counting 
strategy relies on using the correlations between X and Z errors in order to make corrections for 
over-counting that occurs during postselection. The transformed error model, however, contains no 
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such correlation information, so these corrections must be omitted. Second, the CNOT mahgnant 
event upper bounds do not contain information about rest, preparation or measurement locations. 
Level-one error models for these locations can be computed using the same counting strategy as the 
CNOT, but with an appropriately modified exRec.^ 

Finally, in the depolarizing noise model, the error probabilities of each location are constant 
multiples of the noise strength 7. Our upper bounds on the malignant event probabilities, however, 
need not have any scalar relationship. For computer analysis, error probabilities must be re- 
normalized in terms of 7 and error weights recalculated as follows. Let be our upper bound on 
the level-one malignant event mal^;. Then construct a polynomial T^^^ and choose constants oe 
such that 

H'H7)<ai?r«(7) (4.6) 

for all E. The polynomial F*^^) can be viewed as an effective noise strength "reference" for level-one. 
F(^)(7) is a function of 7, but we will usually denote it as F^^^ for convenience of notation. Together 
with weights aE, F^^-* defines a noise model similar to the depolarizing noise model defined in 
Section 4.1. See Appendix D for details of the construction. 

Now the new error model is input into the counting procedure and upper bounds on the level-two 
error rates are computed. Let (T) be the upper bound computed for mal^; at level-two. Then 
we have the following conditions on the level-one and level-two malignant event probabilities: 

Pr[maliJ)]<p(.^)(7)<a£;F« ^^^^ 
Pr[ma4^)] < ^(F^^)) . 

(2) 

We also claim that obeys the following property: 
Claim 4.2. For < e < 1, ^(eF(i)(7)) < e'^v'^\T^^\j)) . 

Proof of this claim is based on the form of the polynomials constructed by our counting 
technique and the fact that our circuits are strictly fault-tolerant. Details of the proof are delegated 
to Appendix D.3. 

We are now in a position to establish conditions for a noise threshold, i.e., the conditions under 
which the probability of a successful simulation can be made arbitrarily close to one. 

Theorem 4.3. Let M be the set of all level-one CNOT, preparation, measurement and rest malig- 
nant events consisting of: maljx, malxi, malxx, maliz, malzi, malzz, maf^^^ , mal?^'^^ ,malx^°''^ , 
mal^^"''^ , malx^ and mafz'^^. Also let 'P^\ V^^'' and T^^^ be polynomials and ue constants as 
discussed above. Then the tolerable noise threshold for depolarizing noise is lower bounded by the 
largest value 'jth such that 

r^E\'^^'H^th)) < aET^'Hlth) (4.8) 

for all malE G M. 

Proof. Assume that ^^^(F^-'^)) < aE^^^\ for all mal^; and 7 G (0,7th). Then, for a fixed 7 G [0,7th), 
there exists some positive e < 1 such that, for all malignant events mal^;, ^^^^(F^^)) < eaE^'"^^ . 

By choosing F^^^ := eF*^"*^^ we obtain an effective noise model for level two in which the weights oe 
are unchanged. Since our counting method depends only on the error weights, the polynomials that 



^Alternatively, they can be incorporated into the CNOT exRecs [AC07]. 
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Verification schedule 


CNOT Pseudothreshold 


Threshold 


Steane-4 


1.72 X 10-3 


1.24 X 10-3 


Overlap-4 


1.73 X 10-3 


1.32 X 10-3 



Table 7: Threshold lower bounds for circuits based on our four-ancilla preparation and verification schedules 
for the Golay code. Thresholds are given with respect to p the probability that a physical CNOT gate fails, 
according to the depolarizing noise model defined in Section 4.1 

upper bound the level-three malignant events will be the same as the polynomials that upper bound 
the level-two malignant events. That is, V^\t) = V^^\t). Thus, 

Pr[malg^] < ^(F^^)) = v'i\eT^^^) < e^aET^^^ , (4.9) 

where the last inequality follows from Claim 4.2. Repeating this process k times yields 

Pr[ma4'+')] < V^^^'^T^')) < e^^-s^^rd) ^ (4.10) 

which approaches zero in the limit of large k. □ 

Testing of the assumption V^\t^^^) < ue'^^^^ over a fixed interval (0,7th) is straightforward 
because, as discussed in Appendix C, all of our malignant event polynomials (including F^^^) are 
monotone non-decreasing up to sufficiently large values of 7. 

4.5 Results: Threshold lower bounds 

Threshold results were obtained by implementing our counting technique as a collection of modules 
written in Python and C; the source code is available at [PRll]. Rigorous threshold lower bounds 
for both of our four-ancilla preparation and verification circuits are given in Table 7. The main 
program takes as input the four-ancilla preparation circuits, the noise model, and the good and 
bad event settings. It outputs, for each type of exRec and each malignant event, a polynomial 
representing an upper bound on the event probability. See Figure 11. These polynomials are either 
evaluated directly to calculate the pseudo-threshold, or processed into a transformed error model 
and fed back into the program. 

The Python modules are broken up according to the components described in Section 4.3. The 
main task for each component is, for each error equivalence class, to compute a weighted count of 
location sets that produce that error. Counts for each component are obtained by first computing 
counts for all of its sub-components and then convolving the results. Details are discussed in 
Appendix B. 

The most time consuming part of the computation involved the CNOT exRec component. 
Computing weighted counts for this component required a custom convolution with nearly four 
trillion combinations. This part of the program was written in C to save time. Even so, running the 
entire program to completion for a fixed ancilla preparation and verification schedule on 31 cores in 
parallel took about four days. 

Our thresholds compare favorably to threshold results for similar circuits. For a six-ancilla 
preparation and verification circuit, Aliferis and Cross [AC07] give a threshold estimate based on 
malignant set sampling of p ~ 1 x lO"* for adversarial noise. Our results beat this by an order 
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(a) X-error malignant events (b) Z-error malignant events 



Figure 11: These plots show upper bounds on probability of malignant events for the different level-one 
exRecs. The mal/x, malxi, malxx, nial/^, malzi and malzz events all pertain to the CNOT exRec; the 
mal^°^ and mal^'^"'' events correspond to the |0) and 1+) preparation exRecs, respectively; mal^'''^'' and 
mal™"''*' correspond to Z-basis and X-basis measurement exRecs; mal^f*^* and mal^"^* pertain to the rest 
exRecs. Note that the upper bound on mal^/ is significantly higher than that of its dual counterpart maljx- 
This is due largely to the arbitrary choice in error correction to correct Z errors first and X errors second. 

of magnitude and provide strong evidence that that our counting technique is an improvement 
over malignant set sampling and malignant set counting for the case of depolarizing noise. Our 
results also essentially close the gap with other other analytical and Monte Carlo threshold estimates 
for depolarizing noise. Using a closed form analysis, Steane [Ste03] estimated a threshold on the 
order of 10~^ for the Golay code with similar noise parameters. Cross et al. [CDT09] estimated a 
pseudo-threshold of 2.25 x 10~^ based on Monte Carlo simulations of a twelve-ancilla preparation 
and verification circuit. 

Beyond circuits based on the Golay code, our results may be the highest rigorous threshold lower 
bounds known. Aliferis et al. [AGP08] prove a lower bound of p > 1.04 x 10^'^ for a slightly stronger 
noise model based a certain kind of stochastic noise. Their analysis applies to teleportation-based 
gates due to Knill [Kni04b] in which Bell pairs encoded into an error correcting code C2 are prepared 
by first encoding each qubit of the C2 block into an error detecting code Ci and performing error 
detection and postselection after each step of the C2 encoding. Our thresholds are only about 20 to 
25 percent better, but apply to circuits that require far less overhead. This implies only that, in the 
depolarizing noise model our analysis is more accurate, and not that our schemes tolerate more 
noise. 

The limiting factor on the threshold value is the event malzi- That is, malzi is the event E for 
which Pr[malg^] = Pr[malg^] takes the smallest value of p. In fact, the corresponding threshold 
values for nearly all Z-error malignant events are lower than threshold values for any of the X-error 
events. This asymmetry is due to the arbitrary order with which we perform error correction — Z 
first, then X. Some X errors resulting from the leading Z-error correction will be corrected by 
the X-error correction that follows. However, Z errors resulting from the X-error correction may 
propagate through the encoded operation before arriving at the Z-error correction on the trailing 
end. As a result, it is more likely for Z errors on individual blocks to be combined by the CNOT 
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gate and create an uncorrectable error. Evidence of this effect can be seen in the level-one malignant 
event probabilities shown in Figure 11. 

It should be possible to reduce such lopsided event probabilities by customizing the error 
correction order for each EC based on the specifics of the ancilla preparation circuits. However, 
analyzing such a scheme would require consideration of up to 36 different full or partial CNOT 
exRecs (two choices for each EC) instead of four and is likely to yield only a small improvement 
in the threshold. Note that other small improvements could be made by, for example, eliminating 
measurement or rest exRecs at level-two. For simplicity, these optimizations were not considered. 

5 Future work 

We have shown two alternative circuits for the fault-tolerant preparation of Golay encoded ancillas. 
Our circuits require a total of only four encoded ancillas, and thus out outperform the previous 
best known circuits in terms of overhead. We have also demonstrated a new malignant set counting 
technique and threshold analysis tailored specifically for depolarizing noise. With this technique, we 
proved a tolerable noise threshold of 1.32 x 10"'^, the highest rigorous threshold known. 

There are a number areas for future work. First, using the overlap encoding method given in 
Section 3.2, we were able to reduce the number of CNOT gates when compared to the standard 
encoding procedure. However, the circuit given in Figure 4 was constructed by hand and is not 
necessarily optimal. It would be ideal have an algorithm for finding a preparation circuit with the 
fewest number of CNOT gates. Second, our techniques for optimizing verification circuit overhead 
could be applied to other large codes. For example, the self-dual BCH [[47, 1, 11]] and concatenated 
Steane [[49, 1,9]] codes (see, e.g., [GB99]) are similar in nature to the Golay code and may yield 
similar results. Variations of the verification procedure could also be analyzed. Overhead might be 
reduced by, for example, attempting to correct some errors detected during verification rather than 
always scrapping the entire procedure. 

Another possible avenue of interest is to apply our malignant set counting technique to other 
types of fault-tolerant error correction methods. In particular, the teleportation-based schemes due 
to Knill are enticing candidates. Simulations indicate that these schemes can tolerate a depolarizing 
noise rate as high as p = 1%; the best rigorous lower bound is p > 1.04 x 10~^ [AGP08], but 
assumes a stronger noise model. By analyzing depolarizing noise directly, our technique might 
provide a tighter bound. However, teleportation-based schemes introduce new analytical challenges. 
In particular, the teleporation-based CNOT gadget is implemented using two Bell pairs and would 
require simultaneous tracking six blocks instead of just two. Additionally, certain schemes may 
require counting of Hadamard and non-transversal single qubit gadgets, further complicating the 
analysis. 
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A Component counting 

A.l Bounding bad events 

Bad fault events are defined, in part, by establishing some limit fcgood on the number of failures K 
within the component. In the X-error case, |+) preparation and X-basis measurement locations are 
ignored (they cannot produce X errors). For a component containing Uc CNOT gates, rir rests, and 
np + rim = fipm |0) preparations and Z-basis measurements, let A^ and /3^(A;) and be defined as 



Ah = {1- 127)"= (1 - 87)"'- (1 - 47)"^"" 




(A.l) 
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Figure 12: X-erior verification. The X-error verification component consists of two Golay encoded |0) 
preparations, a transversal CNOT and a transversal Z-basis measurement. X (xi) ^^'^ ^ id) errors for each 
part are labeled. The output is an X error x and Z error C. 



Then the probability of more than fcgood ^ failures is 



Pr[/Cgood < Kx < fcmax] = ^ f^nik) 

max 



127 x'''" / 87 y / 47 



1-127; VI -87/ VI -47 
ifci 



(A.2) 



^good < 1^1 



The sums are over all possible failure partitions k = {kc, kr, kpm) for which |A;| = kc + kr + kpm is in 
the correct range. The failure partition represents the number of CNOT failures kc, rest failures kr, 
and preparation and measurement failures kpm = kp + km- The upper bound fcmax is used to avoid 
double counting between components and sub-components, and may be omitted in which case take 
/cjnax = ric + rir + Upm + 1- For components with a large number of locations, it is convenient to 
approximate (A.2) by evaluating the sum up to only a fixed number of failures k' = /cgood + const, 
and then upper bounding the rest of the sum by 

Pr[k'<Kx]< /3n(^)(127)'=(87)''-(47)''"" ■ (A.3) 

k: |fc|=fe'+l 

This bound is easy to compute, so long as the number of sub-components is reasonable, and is 
better than the simpler bound ( ) (127)'^ 

The Z-error case is completely analogous except that now | -|-) and X-basis measurement locations 
are counted and |0) preparation and Z-basis measurement locations are ignored. All of the equations 
remain the same. 



A.2 X-error verification 

The X-error verification component is illustrated in Figure 12. It includes three sub-components that 

fail independently. Let (xi;Ci) be the X and Z errors resulting from the first |0) preparation and 

(X2,C2) be the errors from the second |0) preparation. Let (xSjCs) be the errors on the remaining 

transversal CNOT and Z-basis measurement locations; we will denote by (xa^Cs) the portion of 

these errors on the control (upper) code block, and (X31C3) the errors on the target (lower) code 

block. Denote the final output errors by (X;C)- 

(7) • 

Define sub-component j to be bad^ if it contains five or more Z failures. If the sub-component 

(i) (i) (i) (i) 

is not bad^ , it is good^ . Similarly define badj^ and good^' for X failures. 
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Define the X-error verification component to be "bad^" if any of the sub-components are bad^ , 
or there are more than six Z failures. If the component is not bad^, it is good^. Similarly define 
badx and goodj^ for X failures. Define the X-error verification component to be "best" if there are 
fewer than four failures of any kind. 

The quantities that we will compute for an X-error verification component are: 

Pr[(x, C) = {x,z),K = k, bestjaccept], Pr[x = x, Kx = k, goodj^^l accept], 
Pr[C = z,Kz < A;, good^laccept], Pr[badx|accept] and Pr[badz| accept] . 

Here, for example, the first quantity is the probability of X-error x and Z-error z occurring with 
exactly k failures and the best event, conditioned on X-error verification accepting (the event accept). 
The second and third quantities are similar, except tracking only X or Z errors, respectively. 

Begin by placing a lower bound on the probability of the event accept that no X errors are detected. 
Define out(a;) := {x : xix'^ = x}, out(z) := {z : ziZ2z'^ = z} and accept := {x : xiX2x'^ = 0}. Use 

Pr[accept] > Pr[accept, goodj^^] = 1 — Pr[-iaccept, goodjs^^] — Pr[badx] (A. 4) 

and 

3 

Pr^accept, good^] < ^ Pr[xj = Xj, ETxj = good^^] . (A. 5) 

k<6,\k\=k J=l 
x^acceptjf 

Here, the sum is over all possible divisions k = {ki, k2, k^) of the number of failures among the three 
sub-components, and of X errors that lead to a nontrivial syndrome measurement; it is a discrete 
convolution of the error probabilities. Figure 16(a) shows computed lower bounds on Pr[accept] for 
one particular ancilla preparation and verification circuit. 

The calculations we relate here and in the sequel are generally dictated by constraints of 
combinatorial complexity. In Eq. (A. 5), for instance, the number of terms in the sum is, naively, on 
the order of (2^^)^ • 3^ ~ 2 x 10^^, since there are 2^^ inequivalent X errors on a single code block. 
Summing so many terms would be infeasible. In fact, though, the number of inequivalent X errors 
produced by an ancilla preparation circuit with k < 2 faults is much less than 2^^. For ancillas 
prepared using Figure 4, there are 58 inequivalent X errors created with k = 1, and 1225 created 
for k = 2. The number of inequivalent X errors for the transversal CNOT scales as (^/f) S'^. Since 
the number of possible partitions of k faults into m components is 0{k'^), the worst case partition 
with \k\ = 6, k = (1,2,3), involves only about 3 x 10^ error combinations. The bound in (A. 5) can 
therefore be computed with relative ease. This combinatorial analysis is very similar for the other 
equations below. 

We similarly compute for k G {0, 1, 2, 3}, 

3 

P4{X,C) = {x,z),K = k, best, accept] = ^ Y[^^iiXj,Cj) = i^j, zj), Kj = kj] , (A.6) 

\k\=k i=i 

a;£out(a')nacceptx 

2gOUt(2) 

and for A; E {0, . . . , 6}, 

3 

Pv[x = x,Kx = k, goodx, accept] = X] 11 ^^t^^' = ^i' -^^.i = ^j' goo^^''] . (A. 7) 

\k\=k i=i 

xSout(a;)nacceptj(- 
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It is more difficult to compute Pr[C = z^Kz = A;, good^, accept] accurately. The naive bound 
Pr[^ = z, Kz = k, good^, accept] < Pr[C = z, Kz = k, good^] is quite poor, since X-error verification 
catches many Z faults that occur with X faults, i.e., as a y fault. The problem, though, is that we 
lack X-error information with which to determine whether verification is successful or not. Therefore 
we use instead the bound 

Pr = z, Kz < k, good ^] — Pr [C = z, < k, best, -laccept] 



Fr[( = z,Kz < /c, good^ I accept] < 



Pr[accept] 



(A. 



which holds because best is a subset of good^. The numerator can be decomposed as 



k 

Pr[C = z,Kz < k, good^] - Pr[C = z,K <k, best, ^accept] = ^ k') (A. 9) 

k'=0 

where 

V{z, k) := Pr[C = z,Kz = k, good^] - ^ Pr[(x, C) = (x, z), K = k, best, ^accept] . (A.IO) 

X 

The first term of (A.IO) represents the pessimistic assumption that all Z errors pass verification 
under the Z-only noise model. It does not require any X-error information and may be computed 
in the same way as Eqs. (A. 6) and (A. 7): 

3 

Pr[C = z,Kz = k, good^] = J] n P^tO = ^j^Kz = A:,-, good^'^] . (A.ll) 

\k\=k i=i 

2£out(2:) 

The second term uses the full XZ noise model and corrects the over-counting of the first term by 
subtracting off most of correlated Z errors that are rejected. It is nearly identical to (A. 6) except 
that the rejected errors are counted instead of the accepted errors. It is computed as 

3 

Pr[(x, C) = {x,z),K = k, best, -accept] =5^11 P^K^i' 0) = (^J' = ^jl- (^-12) 

\k\=k i=i 

xSout(x)\accept;^ 

2£OUt(2) 

To get a quantitative estimate of the significance of this correction, we show in Table 8 the sum 
of (A.ll) and (A. 12) over all nontrivial Z errors for p = 10~^. From this table, we compute a ratio 
Pi[C 7^ 0, best, -laccept]/ Pr[C / O,good^] of about 0.57, indicating that, as expected, the correction 
cuts the probability of a Z error roughly in half. First-order quantities account for most of the 
correction. Third-order quantites are negligible, providing further justification for our choice of 

khest — 3. 

We see from Figure 16(a) that the lower bound on Z-error verification acceptance at p = 10^^ is 
about 0.84. The correction eliminates better than half of the Z errors going into Z-error verification, 
so we crudely estimate a lower bound without the correction of about 0.63, a decrease by a factor 
of 1.3. There are four Z-error verifications of encoded |0) in the (full) exRec and four similar X-error 
verifications of encoded |+). Thus, in the normalization factor alone, the correction reduces upper 
bounds on the malignant event probabilities (see (A. 23)) by roughly a factor of 1.3® ~ 8. The 
savings is less, of course, as p decreases. 

Finally, bound the probability of the hadx event by Pr[badx] < Pr[i^x > 6] + Pi'ibad^^], and 
use Pr[badj)f laccept] < Pr[badx]/Pr[accept]. The probability of the bad^ event is similarly bounded. 



30 





k = 1 


k = 2 


k = 3 


k = A 


k = 5 


k = 6 


Pj:[C^O,Kz = k,goodz] 


0.1228 


0.0101 


0.0005 


2 X 10-5 


6 X lO"'^ 


1 X 10^ 


Pr[C j^O,K = k, best, -.accept] 


0.0614 


0.0140 


0.0012 









Table 8: This table shows the (un-normalized) probability that a non-trivial Z error occurs during X-error 
verification of \0)^ for the Overlap-4 verification schedule, evaluated at p = 10~^. The first row gives upper 
bounds on the probability of a nontrivial Z-error under the Z-only noise model, assuming that all Z errors 
pass verification. The second row gives lower bounds on the correction applied in (A. 8) based on the full 
depolarizing noise model. 



Verify X (1) 



Verify X (2) 



xi,Ci 



X2,C2 



X3,C3 



Figure 13: Z-error verification. The Z-error verification component consists of two X-error-verified ancillas, 
two transversal rest operations, a transversal CNOT and a transversal X-basis measurement. 



A. 3 Z-error verification 

The Z-error verification component is illustrated in Figure 13 with its three labeled independent 
sub-components. Define the component to be badx if any of the sub-components are badx or there 
are more than seven X failures. The badx events for sub-components one and two are defined 
in Appendix A. 2 and bad)^ occurs when component three contains more than four X failures. 
Thus Pr[badx] < Pr[K > 7] + Ei=i Pi'[bad^^]. Similarly define bad^ for Z failures. Also define 
out(2;) := {x : X1X2X3 = x}, out(2:) := {z : z\z'^ = z] and accept^ := {z : ziZ2z'^ = 0}. 

Begin by placing a lower bound on the acceptance probability Pr[accept] conditioned on accep- 
tance of both X-error verifications. As in the X-error verification component, we use an estimate 
based on the good events only: 

Pr[accept|accept*-^'^^] > Pr[accept, good^laccept*-^'^''] 

= 1 — Pr[-iaccept, good^laccept*^"'^'^-'] — Pr[bad^|accept*'"'^'^'*] 
/Fv[C3 = zs,Kz,3 = k3, good \ 



Pr[-iaccept, good^laccept'-"'^'^-'] = 



• Pr[0 = Kzj = kj, good^'laccept*^-'^] 
|fc|<7 V i=i ^ 

z^accept^ j=l 



(A.13) 



<7 



where Vj is defined according to (A. 10). 
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Now consider Z errors, the simpler case. We have 

/Pr[C3 = Z3,Kz,3 = A:3,g00dg)]\ 

Pr[C = z^Kz < fc, good^, acceptlaccept^^'^-*] < ^ 



n 



Vjizj, kj) 



z£out{z)naccept ^ 
\k\<mm{kj} 

(A.14) 



^^Pr[accept(j)] y 



We upper-bound Pr[C = z,Kz < /c, good^|accept, accept^^'^)] by the minimum of one and the ratio 
of Ptl[( = z, Kz < k, good^, accept|accept(^'^)] divided by the previously computed lower bound on 
Pr [accept] accept*^ -^'^^]. 

Next consider X errors. Under the X-only noise model, we have no information about Z errors 
and we must pessimistically assume that all X errors pass verification (i.e., Pr[x, accept] = Pr[x]). 
In reality, some of the X errors will occur with Z errors and will be rejected. In the same way 
that corrections were applied for Z-error counts during X-error verification, we apply low-order 
corrections to the X-error counts by considering X and Z errors together. In a similar manner to 
Eq. (A. 8) we have 

Pr[x = X, goodj(^, accept! accept'-^'^^] 

^ Pr[x = X, goodj(^, accept*^-*^'^)] — Pr[x = x, best, -laccept, accept^^'^^] (A. 15) 
~ Pr[accept(^)] Pr[accept(2)] 

The numerator terms on the right-hand side can be computed as 

3 

Pr[x = X, goo6x, accept(^'2)] = H ^^t^J = ^i' = A:^, goodJ\ accept^^)] (A.16) 

xeout(x) i=i 

|fc|<7 

Pr[(x, C) = {x, z), best, -.accept, accept^^'^^] = (A.17) 

3 

X] W^'^[{XjXj) = {xj,Zj),Kj = kj,s^cce'p\.^^\ . 

z(iout(z)\accept 2 i=l 
x<^out{x) ,\k\<l 

Equation (A. 15) is then upper bounded by upper bounding (A.16), lower bounding Pr[accept'^^)] and 
Pr[accept''^^], and computing (A. 17) with equality, all of which can be accomplished with quantities 
from Appendix A. 2. 

This correction is less significant than the similar correction applied in X-error verification. 
By the time Z-error verification occurs, many of the X-errors have already been eliminated by 
X-error verification. The X errors that do pass verification are less correlated with Z errors; the 
correction eliminates only about 39 percent of the nontrivial X errors compared to about 57 percent 
for the analogous X-error verification correction. Furthermore, this correction has no effect on 
normalization because acceptance at this stage depends only on Z errors, and there are no further 
postselection steps in the exRec. 

A. 4 Error correction 

The error correction component (Figure 14) contains four independent sub-components. The badx 
events for sub-components one and two are defined in Appendix A. 3. The badx event for sub- 
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Figure 14: The error correction component. Error correction consists of a Z-error correction followed by an 
X-error correction. The Z-error correction requires a verified encoded |0) ancilla and the X-error correction 
requires a verified encoded |+) ancilla. 



components three and four occur when there are more than four failures inside of the sub-component. 
Define the error correction component to be badx if any of the sub-components are badx or there 
are more than eleven X failures total. Similarly define bad^ for Z failures. 

All events are conditioned on the successful verification of both the |0) and |+) ancillas. We have 

2 4 

Pr[badx|accept(^'2)] < ^ Pr[bad^^|accept(j')] + ^Pr[bad^^] + Pr[i^x > H] • (A.18) 
j=i i=3 

Here, accept^-''' means that all verification tests, X and Z, within that subcomponent have passed. 

Consider first X errors. For the two leading error corrections, we are concerned only with the 
case in which the incoming error syndrome is zero. Nonzero syndromes on the input may result in a 
(undetectable) logical error at the output. However, as noted in Section 4.3.4, this has no impact on 
either the output syndrome or the correctness of the 1-Rec. The probability of an X error x at the 
output is expressed as Pr[xout = a^^goodlxm = 0]. 

For the two trailing error corrections, we must consider all possible inequivalent errors on the 
input. However, we do not need to compute the probability of each individual error at the output. 
Rather, we care only about the the probability of an uncorrectable error. Let £ be the set of 
correctable errors on a single block and £ be the set of uncorrectable errors, and for an error e, let 



We use, for d G {0, 1}, 



Pr[i:'(Xout) = (i,gOOdx|Xm = 2;in] < ^ Pr[Xout = X,gOOdx|Xin = Xin] . (A.20) 

x: D(x)=d 

The terms of the sum may be expanded as usual by partitioning k failures among the sub- 
components of the EC. Define out(x) := {x : Covv{x\aXiX2x'^x'l) = x}, where Corr(-) gives 
the classically computed correction for the syndrome of its argument. Then 

4 

Pr[Xout = x,Kx< k, goodjf Ixin = a^in] = X] 11 ^"^^^i = ^j'^xj = ^j, good^^] , (A.21) 

a:eout(x) j=l 
\k\<U 

which can be upper bounded using quantities from Appendix A. 3. Calculations for Z errors are 
analogous except using out(z) := {z : ZinZ2z'^z'^Coicr{zinZiz'^) = z}. 
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Figure 15: The CNOT exRec consists of two leading error corrections, a transversal CNOT with controls on 
block A and targets on block B, and two trailing error corrections. Incremental errors for the LECs and the 
CNOT are labeled, as are the total errors at the output of each block. 



A. 5 exRec 

The exRec is divided into five sub-components: the leading error correction on block A (LEC-A), the 
leading error correction on block B (LEC-B), the transversal CNOT from block A to block B, the 
trailing error correction on block A (TEC-A) and the trailing error correction on block B (TEC-B). 
See Figure 15. 

The badx event for the error correction sub-components is defined in Appendix A. 4. The hadx 
event for the transversal CNOT occurs when it contains more than two X failures. The badx event 
for the exRec (and analogously the bad^ event) occurs when any of the following are true: 

• Any of the sub-components are badx- 

• There are more than 25 X failures in the exRec. 

• There is more than one X failure in the transversal CNOT and there are more than than 
three X failures in each of the two leading ECs. 

The last condition eliminates faults that are particularly difficult to count. The time required 
to count an exRec fault is proportional to the product of the number of unique syndromes that 
can result at the output of the two leading ECs and the transversal CNOT. The number of unique 
syndromes that can result from the transversal CNOT with two X failures is ( ) 3^ = 2277, while 
the number of unique syndromes with one X failure is 23 • 3 = 69. The numbers of unique syndromes 
at the output of the leading ECs are 24, 277 and 2048 for one, two, and three X failures respectively. 
So, for example, the event Kx,i = 2, Kx,2 = 3, Kx,3 = 1 (277 • 2048 • 69 4 • 10^) requires far less 
time than the event Kx,i = 2, Kx,2 = 3, Kx,3 = 2 (277 • 2048 • 2277 ^ 1 • 10^). In particular, we 
would like to avoid counting faults for which Kx,3 = 2. 

The probability of the badx event, conditioned on acceptance of all X-error and Z-error 
verifications is 

Pr[badx|accept(i'2A5)] < ^ Pr[bad^^|accept(^)] + Pr[bad5^^] 

je{l,2,4,5} 

2 (A.22) 

+ Pr[i^x > 25] + Pr[i^x,3 > 1] H ^^t^^-i > 3|accept(^')] . 

i=i 
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Computed upper bounds for this quantity are plotted in Figure 16(b). Naively one might expect 
bounds for partial exRecs — those for which one or more TECs have been removed — to be lower 
than bound for the full exRec by as much as a factor of two. However, (A. 22) is dominated by 

(3) 

either the transversal CNOT (Pr[bad3j^ ]) or the condition involving the transversal CNOT and the 
two LECs {Ft:[Kx,3 > 1] 11^=1 ^^[^xj > Slaccept^-')]) over most of the domain of p. Thus removing 
the TECs has little impact on the probability that the exRec is bad. 



Recall from (A. 19) the definition D : {£ D £) ^ {0, 1}. For x = {xi,X2,X3,x'c 



out; "^out 

z = zi, Z2, 2^3, Zout, Zout), we can then define the malignant X- and Z-error events for the CNOT 
1-Rec as 



t) and 



mal/x (x) 
malx7(^) 
malxx(^) 
mal/^(z) 
malzi{z) 



[D{xi) = A [D{xi) © D{x2) / I)(x;',t)] 

[D{xi) / D{x',J] A [D{xi) © D{X2) = D{xl,)] 
[D{xi) / D{x',J] A [D{xi) © D{X2) / Dix^,,)] 
[D{z^) © D(Z2) = Z)(4ut)] A [D{Z2) / i?(4'ut)] 
[Diz,) © Diz2) + D(4ut)] A {D{Z2) = D{zl,,)\ 
[Z)(zi) © D{Z2) / Z)(4ut)] A {D{Z2) / i?(4'ut) 



(A.23) 



These are the events for which the behavior of the 1-Rec differs from the behavior of an ideal decoder 
followed by an ideal (level-zero) CNOT gate, i.e., the 1-Rec is incorrect. The subscripts denote the 
logical error introduced by the exRec. For example, mal/x is the event in which the action of the 
exRec followed by an ideal decoder is the same as that of an ideal decoder followed by an ideal 
CNOT gate plus the two-qubit error error 1 ® X. 

For each error event E G {/X, AT/, XX}, we are interested in the probability that mal£;(x) 
occurs along with the goodj^ event. Define G := {k : \k\ < 25, /^s < 1 if A;i > 4 and k2 > 4}. Then, 
letting x'in and x'i'n be the errors input to the two TECs, 



Pr[mal£;(x),good 



E 



Xi,Kx,: 



fcj,good^^] 



• Pi'[xc 



= x'ontjKxA = /c4,good5^^|xln = 

Ct>^X,5 = fc5,g00dj^|xrn = 2:1X2X3] 



out 



out 



(A.24) 



which may be upper bounded using quantities from Appendix A. 4. Calculation of Pr[mal£;(C), good^ 
for E G {IZ, ZI, ZZ} is analogous. 



B Implementation of component counting 

Equations (A. 22) and (A.24) in Appendix A are conceptually straightforward and easy to compute 
numerically for a fixed 7. However, we would like to compute exact bounds that hold for a range 
of 7. In this appendix, we will specify a few of the implementation details that allow for maintaining 
the bounds as polynomials with integer coefficients. 

The ultimate goal is to compute upper bounds on the probabilities of malignant events at the 
outermost layer of the exRec. That is, we want to compute (A. 22), (A.24) and combine them to get 

Pr[mal£;(x)|accept] < Pr[mal£;(x), goodj(^|accept] -1- Pr[badx|accept] . (B.l) 
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Figure 16: Plotted in (a) are lower bounds on the Overlap-4 acceptance probabilities for the two X-error 
verifications (accept'^^^ and accept^^^) and for the Z-error verification (accept) conditioned on success of the 
X-error verifications. The plot in (b) shows upper bounds on (A. 22), the probability that the CNOT exRec 
is bad. 



The right-hand side of this inequality decomposes into sums of individual component quantities of 
the form 

Pr[x = x,Kx = 'k\= ^ Pr[x = x,Kx = k\ , 2) 

\k\=k 

where k = {kc, kr, kp, km) expresses the number of failing CNOT, rest, |0) preparation and Z-basis 
measurements, respectively. 

For each term in the sum, the number of failures for each type of location is fixed, but the 
particular locations on which those failures occur are not fixed, nor are the errors that occur at 
those locations. Let L{k) := {{lc-,lr,lp,lm) '■ {\lc\, \lr\, \lp\, \lm\) = k} be the set of all possible tuples 
of failing locations consistent with k. Also, let E(l) be the set of all possible tuples of X errors 
consistent with failures at locations I. To fix the locations and the errors, use 

Pr[x = X, Kx = k]= Pi'ix = X, E 

T&L{k),e<^E{T) 

^ F{x,e)Vx[E 

l&L{k),ei^E{l) 

where in the second line we have made the substitution J-{x, e) = Vilx = x\E = e\. 

The boolean function J-{x, e) takes value one if the component produces the error x for a given 
"configuration" of errors e and value zero otherwise. The error configuration e fully specifies the 
the locations that have failed and the error at each failing location. Let nc,nr,np,nm be the total 
number of CNOT, rest, |0) preparations and Z-basis measurements in the component, respectively. 



e1 



(B.3) 
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Then from the marginal noise model discussed in Section 4.1 we have 



Pr[E = e] = (1-47)""+"- (1-87)"'- (1-127)"^' ^ ^ I °' ^ I ' 



l_4^y VI -877 VI -127. ^g^^^ 

< ^^4'=2'='-f — - — ' 
- Vl-127 

where Afi is defined as in (A.l). This inequality is a reasonable approximation for the range 
7 ^ ^^^f — with which we are concerned. It allows us to move 7 into a prefactor in front of the 
sum of (B.2), and permits an integer representation in the computer analysis. Indeed, substituting 
back into equation (B.2) gives 

Pr[x = x,Kx = k]< An ( Y^^) ' 4'^2^' -^(^' ^ ■ (B-5) 

\k\=k 
T&L{k),e'^E{T) 

X- and Z-error verification require corrections that involve counting X and Z errors together 
(Appendix A. 2). In that case, the probability of an error configuration is computed according to 
Definition 4.1 and we require a lower bound. We have 

1,1 / 4t \ kp+km / 4^ \kr / ^ 

Pr[^ = ^ = (1 - 47)"p+"-(l - 127)"'- (1 - 157)"^' ^ ^ ' y \ f y 



.1-47/ Vl-127/ VI -157 

- ^ ' Vl-47 

> J^^l g/^kp + km+kr 



(B.6) 



1 - 127 

Here, and n'^ are the total numbers of preparation and measurement locations (including now |+) 
preparations and X-basis measurements), and A'{n') = (1 — 47)"p'^"'"(l — 127)"''(1 — 157)""=. The 
scaling factor 5 = [_ ^ ( ) converts the XZ probability into a form that is compatible 
with X-only and Z-only probabilities (Eq. (B.4)) while maintaining the lower bound and integer 
representation. The constant 7max is chosen so that it is higher than the expected threshold value. 
Now, (A. 8) and (A. 15) can be rewritten so that the sums do not depend on 7, and terms with 
corrections such as (A. 10) can be represented by a single integer. 

Another advantage of counting component probabilities as likelihoods, is that the counts compose 
nicely. If we apply (B.2) to itself and combine with (B.5), we end up with 



Pr[x = x,Kx = k]= ^ Pr[xj = Xj,Kx,j = kj] 



\k\=k 3 
x£out(a;) 

<aJ ^ 



1 - 127 



En E 4'=^2^^"--^(^.,e) 



\k\=k 1 \kj\=kj 
x(^out{x) l(iL{kj),e(iE{l) 



(B.7) 
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The substitution made in the first hne can be apphed successively for each sub-component j. 
Once the lowest level component is reached, we use (B.5) to push dependence on 7 outside of the 
sum. The integer value inside of the brackets is the discrete convolution of weighted counts from 
the sub-components summed over all possible failure partitions k of size k. It is a weighted count of 
all possible ways to produce error x with an order k fault. 

The primary task of the Python program is to compute J- for each (good) error configuration, 
starting with the lowest level component, and to store the resulting weighted sums 

4''2''-T{x,e) (B.8) 

\k\=k 
T&L(k),e&E(l) 

(or equivalent) for use in the counting for larger components. At each level, counts for the sub- 
components are convolved to generate new counts. The prefactor ^n( i_i2^ ) need only be computed 
at the end, when calculating the threshold. 



C Monotonicity of malignant event upper bounds 

We now show how to prove that the level-one malignant event polynomials constructed by our 
counting method are monotone non-decreasing over the interval 7 S [0, 1.8 x 10~^] , which encompasses 
our threshold values. Monotonicity of level-one upper bounds is not strictly required for the proof 
of Theorem 4.3. However, it is useful constructing the transformed noise model (see Appendix D.2) 
and in finding the maximum 7 that satisfies 'P^^\t^^^) < a^r^i). Monotonicity of upper bounds for 
level-two and above follow from Claim 4.2 which depends only on the construction defined by our 
counting method and not on the actual counting results — see Appendix D.3. Level-one polynomials, 
however, can include terms that decrease with 7. Monotonicity statements for level-one bounds, 
therefore, depend on coefficients — i.e., weighted counts — computed by our Python implementation. 

Recall that the upper bound Ve for malignant event mal^ as defined by Appendix A is of the 
form 

Consider first the Pr [bad | accept] term. This term is expressed as sums and products of Pr[bad] 
terms, some of which contain Pr[accept] terms in the denominator. The Pr[bad] and Pr[accept] 
terms are, in turn, expressed as sums and products of polynomials Q of the form 

where 2(7) > for all 7 > 0, and integer coefficients c{k) do not depend on 7. The quantity 
Pr[mal£;, good] is also expressed in this way. Our goal then is to use (C.2) to show that Pr[accept] 
is monotone non-increasing, and that Pr[bad] and Pr[mal£;, good]/ Pr[accept] are monotone non- 
decreasing over the desired range. Note that Pr [male, good] is, in fact, not monotone over our 
chosen range. 
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The derivative of Q is a sum of two terms. The first term can be lower-bounded by using 

>-{l2nc + Snr + Anpm'' 



d-i ^ ' 'Vl-127/ Vl-127 1-87 1-47/ ' 'Vl-127 



(C.3) 



1 - 127 

If ah coefficients c(/c) are non-negative, then the second term may be lower-bounded as 

A^yc(k)U^^\' > . (C.4) 

""Z^ 'd^\l-l2jJ -7^axl-127 ^ ' 

k 

In the case of Pr[bad], all of the coefficients c{k) are, indeed, non-negative. Using 7min = 0, and 
^min = ^good + 1 we obtain 

dPr[bad] ^ + 1 _ ^2,^ _ _ ^^ Pr[bad] ^^^^^ 



d'y \ 7inax / 1 - 127 

which is non-negative over [0, 1.8 x 10^^] for all of our components. 

We would like to upper bound the denominator quantities Pr [accept] using a condition analogous 
to (C.5). Such a condition is insufficient, however, because for X-error verification = 0, and for 
Z-error verification some coefficients may be negative due to low-order XZ corrections. Instead, we 
bound the second derivative using the following inequality due to Markov. 

Lemma C.l (see, e.g., [Haz90] pp. 100). Let Q be a univariate polynomial of degree at most n. 
Then the m-th order derivative Q("^) is bounded by 

max |Q(-)(7)|<^ '^"Lro^Jni. r™ J^^^)'' ^^'^^ 

mint'yjnaxl 



In our case, n is bounded by the number of locations in the corresponding component. The 
maximum of Q is obtained by separating the positive and negative coefficients and upper bounding by 

76[7min,7max] ^^7^ (1 " 127maxj (1 - l^Tminj 

If A is the bound obtained from Lemma C.l, then the first derivative can be bounded using 

^ max Q(1) < Q(^)(7min) + A(7^ax - 7min) • (C.8) 

7G[7min,7max] 

Depending on the values of the coefficients c{k), bounding the first derivative below zero may require 
dividing up the interval into smaller sub-intervals and successively applying (C.8). 

Analysis for Q = Pr[mal£;, good]/ Pr[accept] is similar. Monotonicity over the range [e, 7max] for 
small constant e can be shown by using the lower bound equivalent of (C.8). The maximum of Q is 
calculated by using (C.7) on Pr[mal£;, good] and evaluating Pr[accept] at 7max- Lower bounding the 
first derivative in this way is not adequate for [0, e], however, because the first derivative vanishes at 
7 = 0. Due to the strict fault-tolerance of our circuits, coefficients c{k) of Pr[mal£;, good] are zero 
for < A; < 3 and so the derivatives up to third order are also zero. To show monotonicity over [0, e] 
we evaluate the fourth derivative at 7 = and then use Lemma C.l to bound the fifth derivative. 
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D The transformed noise model 



D.l Construction of the model 

The transformed noise model uses upper bounds on the level-one malignant event probabilities to 
model each 1-Rec as a single effective "location" in the level-two simulation. The construction here 
considers only X-error malignant events. Construction for Z-error events is nearly identical, and the 
upper bounds obtained from level-one counting contain no information about X and Z correlations 
so X and Z errors are not considered together at level-two. 

From level-one counting, we have upper bounds on Pr[mal/x]) Pr[iiialx/], and Pr[malxx] of 
the transversal CNOT, Pr[mal^''^] of encoded |0) preparation, Pr[mal™'^^^] of transversal Z-basis 
measurement and Pr[mal^'^*] of the transversal rest. Each of these bounds is a polynomial in 7, 
the probability of a given error on a physical CNOT (see Figure 11(a)). Denote the upper bound 
polynomial for each event mal^; by Ve- Then let Fx (7) be a polynomial defined over the interval 
< 7 < 7max such that, for all mal^;, 

Ve{i) < aETxi-f) (D.l) 

where «£; > 1 is a constant. The procedure for obtaining such a polynomial Tx and constants aE 
is outlined in the Section D.2. 

Now consider the level-two simulation. Level-two rectangles are composed of many level-one 
rectangles. Following [AGP06] we replace each 1-Rec with an implementation of the corresponding 
(level-zero) gate, starting with the right-most 1-Recs and moving left. If a 1-Rec is correct, then 
it is replaced with an ideal gate. If a 1-Rec is incorrect, then the entire exRec is replaced with a 
faulty version of the gate. Unlike [AGP06], however, exRecs containing incorrect rectangles are 
replaced according to the malignant event that occurred. For example, a CNOT 1-Rec that is 
mal/x is replaced with an ideal CNOT gate followed by the error I ®X. A 1-Rec [A) that precedes 
an incorrect 1-Rec {B) is replaced with a faulty gate only if A is still incorrect after the ECs 
shared with the exRec containing B have been removed. Such an incorrect 1-Rec {A) is said to be 
"independently" incorrect. 

Let i^i , iir2 , -^3 , -f^4, be the number of level-one exRecs that are independently mal/x, malx/, 
malxX) mal^'^'', vna^^ and mal^*^*, respectively. Then the probability Pr[^ = k] of this event is 
bounded by 

6 

VT[K = k]<Tx{lPJ[\a,f^ (D.2) 

i=l 

where the ceiling is taken to allow integer representation in the computer analysis. Thus, characteri- 
zation and analysis of the level-two components is similar to that used for the depolarizing noise 
model in Section A except that the weights associated with each type of error are different. There 
is also no prefactor A^ in (D.2) as there is in (B.4). This is because the error probabilities are now 
specified as upper bounds rather than equalities. We do not have a proper upper bound, other than 
one, for the probability that a location (1-Rec) does not fail. 

D.2 Bounding malignant event polynomials 

Construction of the transformed noise model requires bounding of several sets of polynomials in two 
different ways. The first case compares polynomials of a fixed malignant event for each possible 



40 




0.0000 0.0005 




(a) 



(b) 





(c) 



(d) 




0.0005 0.0010 



0.0020 0.0025 




(e) 



(f) 



Figure 17: The above plots show upper bounds on the probabihty of mahgnant events for the level-one CNOT 
exRec where the error corrections are based on Overlap-4 verification schedule. Upper bounds are plotted 
separately for each of four different CNOT exRecs: the full exRec (labeled AB), and the three incomplete 
exRecs in which the TEC on block A — the control block — has been removed (-B), the TEC on block B — the 
target block — has been removed (A-) or the TEC on both blocks have been removed ( — ). Also shown is the 
polynomial "max" used to simultaneously upper bound all four possibilities (see Section 4.4.2). 
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partial CNOT exRec (see Figure 17). In this case, we require only a single polynomial V* which 
is strictly greater than or equal to all other polynomials in the set P := {Ve} over the interval 
[0, 7max]- The monotonicity of each of the polynomials (see Section C) over this interval means that 
constructing a V* is relatively simple. First, choose some reasonably small 7min > and fix some 
A > 0. Then a sufficient condition for V* to be greater than all polynomials in P over the interval 

[Tmin 5 Tmax] is 

7^*(7mm + nA) > P£(7mm + (« + 1)A) (D.3) 

for all Ve £ P and all integers < n < [(7max — 7min)/A] . V* can be constructed by taking the 
Ve with the largest value at 7max (say), and adding a constant offset of at least viiax.EV E{lm\n) so 
that (D.3) is satisfied. Maximality over the remaining interval [0,7min] follows by monotonicity. 

In the second case, we compare malignant events from different types of exRecs. We need to 
construct F and determine values ue for which the upper bound Ve < a£;F in (D.l) is satisfied. 
Construction of F is similar to that of V* from above. Let Vj be the polynomial with the largest 
derivative at 7max- Take Vj and divide by some appropriately large value r. Then add a constant 
offset e := maxj^j ^4(7111111) so that F = Vj/r + e. Finally, for each mal^;, find the minimum value of 
ue such that V* := a£;F satisfies condition (D.3). 

In practice, the quality of the resulting bounds depends on the choice of 7min and the number of 
plotted points n. We find that a value of jmin = 7max/10 or 7inin = 7max/100, and n = 1000 works 
well. More sophisticated methods can also be used. For example, the value of A could vary over the 
interval to better capture exponential behavior of the polynomials. 



D.3 Proof of Claim 4.2 

We conclude our analysis of the transformed error model by proving Claim 4.2 that the level- two 
malignant event upper bounds decrease exponentially with 7. 

(2) 

Proof. From Appendix A and Appendix D.l we see that V^ is expressed as 
The Pr[mal£;, good] term is expressed as a sum of the form 

^max 



fc=0 

where all of the coefficients c{k) are non-negative (because there are no XZ corrections) and it is 
understood that F is a function of 7. The Pr[accept] term in the denominator is a product of terms 
of the form 

^max 

1 - cik)r' (D.6) 

k=0 

where, again, all c{k) are non-negative. Pr [bad | accept] is a sum of terms similar to (D.5), some of 
which contain (D.6) terms in the denominator. 



42 



Due to the strict fault-tolerance of our circuits, the coefficients c{k) of (D.5) and the numerator 
coefficients of Pr[bad| accept] are zero for k < 3. Therefore, for < e < 1, (eT) is a sum of 
non-negative terms of the form 

which completes the proof. □ 
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